- Devel - libvirt List Archives

[libvirt] [PATCH] docs: Add missed RNG schema for interface
by Osier Yang 12 Jan '12

12 Jan '12

We support <interface> of type "mcast", "server", and "client", but the RNG schema for them are missed. --- docs/schemas/domaincommon.rng | 44 +++++++++++++++++++++++++++++++++++++++++ 1 files changed, 44 insertions(+), 0 deletions(-) diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index e93ae77..2caa781 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -1295,6 +1295,50 @@ <ref name="interface-options"/> </interleave> </group> + <group> + <attribute name="type"> + <value>mcast</value> + </attribute> + <element name="source"> + <attribute name="address"> + <ref name="ipv4Addr"/> + </attribute> + <attribute name="port"> + <ref name="PortNumber"/> + </attribute> + <empty/> + </element> + </group> + <group> + <attribute name="type"> + <value>client</value> + </attribute> + <element name="source"> + <attribute name="address"> + <ref name="ipv4Addr"/> + </attribute> + <attribute name="port"> + <ref name="PortNumber"/> + </attribute> + <empty/> + </element> + </group> + <group> + <attribute name="type"> + <value>server</value> + </attribute> + <element name="source"> + <optional> + <attribute name="address"> + <ref name="ipv4Addr"/> + </attribute> + </optional> + <attribute name="port"> + <ref name="PortNumber"/> + </attribute> + <empty/> + </element> + </group> </choice> </element> </define> -- 1.7.7.3

3 4

[libvirt] [PATCH] virsh: New command print summary of all virtual interfaces
by Osier Yang 12 Jan '12

12 Jan '12

Just like command "domblklist", the command extracts "type", "source", "target", "model", and "MAC" of all virtual interfaces from domain XML (live or persistent). --- tools/virsh.c | 98 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ tools/virsh.pod | 9 +++++ 2 files changed, 107 insertions(+), 0 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index fb940b8..3af2fd7 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -1984,6 +1984,103 @@ cleanup: } /* + * "domiflist" command + */ +static const vshCmdInfo info_domiflist[] = { + {"help", N_("list all domain virtual interfaces")}, + {"desc", N_("Get the summary of virtual interfaces for a domain.")}, + {NULL, NULL} +}; + +static const vshCmdOptDef opts_domiflist[] = { + {"domain", VSH_OT_DATA, VSH_OFLAG_REQ, N_("domain name, id or uuid")}, + {"inactive", VSH_OT_BOOL, 0, + N_("get inactive rather than running configuration")}, + {NULL, 0, 0, NULL} +}; + +static bool +cmdDomiflist(vshControl *ctl, const vshCmd *cmd) +{ + virDomainPtr dom; + bool ret = false; + unsigned int flags = 0; + char *xml = NULL; + xmlDocPtr xmldoc = NULL; + xmlXPathContextPtr ctxt = NULL; + int ninterfaces; + xmlNodePtr *interfaces = NULL; + int i; + + if (vshCommandOptBool(cmd, "inactive")) + flags |= VIR_DOMAIN_XML_INACTIVE; + + if (!vshConnectionUsability(ctl, ctl->conn)) + return false; + + if (!(dom = vshCommandOptDomain(ctl, cmd, NULL))) + return false; + + xml = virDomainGetXMLDesc(dom, flags); + if (!xml) + goto cleanup; + + xmldoc = virXMLParseStringCtxt(xml, _("(domain_definition)"), &ctxt); + if (!xmldoc) + goto cleanup; + + ninterfaces = virXPathNodeSet("./devices/interface", ctxt, &interfaces); + if (ninterfaces < 0) + goto cleanup; + + vshPrint(ctl, "%-10s %-10s %-10s %-11s %s\n", _("Type"), _("Source"), + _("Target"), _("Model"), _("MAC")); + vshPrint(ctl, "-------------------------------------------------------\n"); + + for (i = 0; i < ninterfaces; i++) { + char *type = NULL; + char *source = NULL; + char *target = NULL; + char *model = NULL; + char *mac = NULL; + + ctxt->node = interfaces[i]; + type = virXPathString("string(./@type)", ctxt); + + source = virXPathString("string(./source/@bridge" + "|./source/@dev" + "|./source/@network" + "|./source/@name)", ctxt); + + target = virXPathString("string(./target/@dev)", ctxt); + model = virXPathString("string(./model/@type)", ctxt); + mac = virXPathString("string(./mac/@address)", ctxt); + + vshPrint(ctl, "%-10s %-10s %-10s %-11s %-10s\n", type, + source ? source : "-", + target ? target : "-", + model ? model : "-", + mac ? mac : "-"); + + VIR_FREE(type); + VIR_FREE(source); + VIR_FREE(target); + VIR_FREE(model); + VIR_FREE(mac); + } + + ret = true; + +cleanup: + VIR_FREE(interfaces); + virDomainFree(dom); + VIR_FREE(xml); + xmlFreeDoc(xmldoc); + xmlXPathFreeContext(ctxt); + return ret; +} + +/* * "suspend" command */ static const vshCmdInfo info_suspend[] = { @@ -15595,6 +15692,7 @@ static const vshCmdDef domMonitoringCmds[] = { {"domblkstat", cmdDomblkstat, opts_domblkstat, info_domblkstat, 0}, {"domcontrol", cmdDomControl, opts_domcontrol, info_domcontrol, 0}, {"domif-getlink", cmdDomIfGetLink, opts_domif_getlink, info_domif_getlink, 0}, + {"domiflist", cmdDomiflist, opts_domiflist, info_domiflist, 0}, {"domifstat", cmdDomIfstat, opts_domifstat, info_domifstat, 0}, {"dominfo", cmdDominfo, opts_dominfo, info_dominfo, 0}, {"dommemstat", cmdDomMemStat, opts_dommemstat, info_dommemstat, 0}, diff --git a/tools/virsh.pod b/tools/virsh.pod index 1abf448..bae6a13 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -522,6 +522,15 @@ domain. Other contexts that require a block device name (such as I<domblkinfo> or I<snapshot-create> for disk snapshots) will accept either target or unique source names printed by this command. +=item B<domiflist> I<domain> [I<--inactive>] + +Print a table showing the brief information of all virtual interfaces +associated with I<domain>. If I<--inactive> is specified, query the +virtual interfaces that will be used on the next boot, rather than those +currently in use by a running domain. Other contexts that require a MAC +address of virtual interface (such as I<detach-interface> or +I<domif-setlink>) will accept the MAC address printed by this command. + =item B<blockpull> I<domain> I<path> [I<bandwidth>] Populate a disk from its backing image. Once all data from its backing -- 1.7.7.3

2 2

[libvirt] [PATCH v2] Do not generate security_model when fs driver is anything but 'path'
by Deepak C Shetty 12 Jan '12

12 Jan '12

QEMU does not support security_model for anything but 'path' fs driver type. Currently in libvirt, when security_model ( accessmode attribute) is not specified it auto-generates it irrespective of the fs driver type, which can result in a qemu error for drivers other than path. This patch ensures that the qemu cmdline is correctly generated by taking into account the fs driver type. Signed-off-by: Deepak C Shetty <deepakcs(a)linux.vnet.ibm.com> --- v2: - removed xml accessmode changes as suggested by dan. - every fs driver having a default accessmode always, retained. src/qemu/qemu_command.c | 23 +++++++++++++++++------ 1 files changed, 17 insertions(+), 6 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index ea1b763..e3a509a 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -2098,13 +2098,24 @@ char *qemuBuildFSStr(virDomainFSDefPtr fs, } virBufferAdd(&opt, driver, -1); - if (fs->accessmode == VIR_DOMAIN_FS_ACCESSMODE_MAPPED) { - virBufferAddLit(&opt, ",security_model=mapped"); - } else if(fs->accessmode == VIR_DOMAIN_FS_ACCESSMODE_PASSTHROUGH) { - virBufferAddLit(&opt, ",security_model=passthrough"); - } else if(fs->accessmode == VIR_DOMAIN_FS_ACCESSMODE_SQUASH) { - virBufferAddLit(&opt, ",security_model=none"); + if (fs->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_PATH || + fs->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_DEFAULT) { + if (fs->accessmode == VIR_DOMAIN_FS_ACCESSMODE_MAPPED) { + virBufferAddLit(&opt, ",security_model=mapped"); + } else if(fs->accessmode == VIR_DOMAIN_FS_ACCESSMODE_PASSTHROUGH) { + virBufferAddLit(&opt, ",security_model=passthrough"); + } else if(fs->accessmode == VIR_DOMAIN_FS_ACCESSMODE_SQUASH) { + virBufferAddLit(&opt, ",security_model=none"); + } + } else { + /* For other fs drivers, default(passthru) should always */ + /* be supported */ + if (fs->accessmode != VIR_DOMAIN_FS_ACCESSMODE_PASSTHROUGH) { + qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("only supports passthrough accessmode")); + } } + virBufferAsprintf(&opt, ",id=%s%s", QEMU_FSDEV_HOST_PREFIX, fs->info.alias); virBufferAsprintf(&opt, ",path=%s", fs->src);

3 5

[libvirt] [PATCH] Revert "virsh: Increase device-detach intelligence"
by Osier Yang 12 Jan '12

12 Jan '12

This reverts commit ea7182c29f185e7c1527b10fbe16dc4ba1f45a88. Conflicts are resolved. This is a temporary reverting for it introduces regression of device detaching (any device XML doesn't uses the same order as libvirt generates, or has uses decimal for some attrs (e.g. "slot") will cause the failure, as virsh compares the XML simply earlier before internal parsing). We could take the patch back when the new API for normalizing XML is ready. --- tools/virsh.c | 292 +++----------------------------------------------------- 1 files changed, 16 insertions(+), 276 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index 04c1f6e..fb940b8 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -60,7 +60,6 @@ #include "command.h" #include "virkeycode.h" #include "virnetdevbandwidth.h" -#include "util/bitmap.h" #include "conf/domain_conf.h" static char *progname; @@ -12571,251 +12570,6 @@ cmdAttachDevice(vshControl *ctl, const vshCmd *cmd) return true; } -/** - * Check if n1 is superset of n2, meaning n1 contains all elements and - * attributes as n2 at least. Including children. - * @n1 first node - * @n2 second node - * returns true in case n1 covers n2, false otherwise. - */ -static bool -vshNodeIsSuperset(xmlNodePtr n1, xmlNodePtr n2) -{ - xmlNodePtr child1, child2; - xmlAttrPtr attr; - char *prop1, *prop2; - bool found; - bool visited; - bool ret = false; - long n1_child_size, n2_child_size, n1_iter; - virBitmapPtr bitmap; - - if (!n1 && !n2) - return true; - - if (!n1 || !n2) - return false; - - if (!xmlStrEqual(n1->name, n2->name)) - return false; - - /* Iterate over n2 attributes and check if n1 contains them*/ - attr = n2->properties; - while (attr) { - if (attr->type == XML_ATTRIBUTE_NODE) { - prop1 = virXMLPropString(n1, (const char *) attr->name); - prop2 = virXMLPropString(n2, (const char *) attr->name); - if (STRNEQ_NULLABLE(prop1, prop2)) { - xmlFree(prop1); - xmlFree(prop2); - return false; - } - xmlFree(prop1); - xmlFree(prop2); - } - attr = attr->next; - } - - n1_child_size = virXMLChildElementCount(n1); - n2_child_size = virXMLChildElementCount(n2); - if (n1_child_size < 0 || n2_child_size < 0 || - n1_child_size < n2_child_size) - return false; - - if (n1_child_size == 0 && n2_child_size == 0) - return true; - - if (!(bitmap = virBitmapAlloc(n1_child_size))) { - virReportOOMError(); - return false; - } - - child2 = n2->children; - while (child2) { - if (child2->type != XML_ELEMENT_NODE) { - child2 = child2->next; - continue; - } - - child1 = n1->children; - n1_iter = 0; - found = false; - while (child1) { - if (child1->type != XML_ELEMENT_NODE) { - child1 = child1->next; - continue; - } - - if (virBitmapGetBit(bitmap, n1_iter, &visited) < 0) { - vshError(NULL, "%s", _("Bad child elements counting.")); - goto cleanup; - } - - if (visited) { - child1 = child1->next; - n1_iter++; - continue; - } - - if (xmlStrEqual(child1->name, child2->name)) { - found = true; - if (virBitmapSetBit(bitmap, n1_iter) < 0) { - vshError(NULL, "%s", _("Bad child elements counting.")); - goto cleanup; - } - - if (!vshNodeIsSuperset(child1, child2)) - goto cleanup; - - break; - } - - child1 = child1->next; - n1_iter++; - } - - if (!found) - goto cleanup; - - child2 = child2->next; - } - - ret = true; - -cleanup: - virBitmapFree(bitmap); - return ret; -} - -/** - * vshCompleteXMLFromDomain: - * @ctl vshControl for error messages printing - * @dom domain - * @oldXML device XML before - * @newXML and after completion - * - * For given domain and (probably incomplete) device XML specification try to - * find such device in domain and complete missing parts. This is however - * possible only when given device XML is sufficiently precise so it addresses - * only one device. - * - * Returns -2 when no such device exists in domain, -3 when given XML selects many - * (is too ambiguous), 0 in case of success. Otherwise returns -1. @newXML - * is touched only in case of success. - */ -static int -vshCompleteXMLFromDomain(vshControl *ctl, virDomainPtr dom, char *oldXML, - char **newXML) -{ - int funcRet = -1; - char *domXML = NULL; - xmlDocPtr domDoc = NULL, devDoc = NULL; - xmlNodePtr node = NULL; - xmlXPathContextPtr domCtxt = NULL, devCtxt = NULL; - xmlNodePtr *devices = NULL; - xmlSaveCtxtPtr sctxt = NULL; - int devices_size; - char *xpath = NULL; - xmlBufferPtr buf = NULL; - int i = 0; - int indx = -1; - - if (!(domXML = virDomainGetXMLDesc(dom, 0))) { - vshError(ctl, _("couldn't get XML description of domain %s"), - virDomainGetName(dom)); - goto cleanup; - } - - domDoc = virXMLParseStringCtxt(domXML, _("(domain_definition)"), &domCtxt); - if (!domDoc) { - vshError(ctl, _("Failed to parse domain definition xml")); - goto cleanup; - } - - devDoc = virXMLParseStringCtxt(oldXML, _("(device_definition)"), &devCtxt); - if (!devDoc) { - vshError(ctl, _("Failed to parse device definition xml")); - goto cleanup; - } - - node = xmlDocGetRootElement(devDoc); - - buf = xmlBufferCreate(); - if (!buf) { - vshError(ctl, "%s", _("out of memory")); - goto cleanup; - } - - /* Get all possible devices */ - virAsprintf(&xpath, "/domain/devices/%s", node->name); - if (!xpath) { - virReportOOMError(); - goto cleanup; - } - devices_size = virXPathNodeSet(xpath, domCtxt, &devices); - - if (devices_size < 0) { - /* error */ - vshError(ctl, "%s", _("error when selecting nodes")); - goto cleanup; - } else if (devices_size == 0) { - /* no such device */ - funcRet = -2; - goto cleanup; - } - - /* and refine */ - for (i = 0; i < devices_size; i++) { - if (vshNodeIsSuperset(devices[i], node)) { - if (indx >= 0) { - funcRet = -3; /* ambiguous */ - goto cleanup; - } - indx = i; - } - } - - if (indx < 0) { - funcRet = -2; /* no such device */ - goto cleanup; - } - - vshDebug(ctl, VSH_ERR_DEBUG, "Found device at pos %d\n", indx); - - if (newXML) { - sctxt = xmlSaveToBuffer(buf, NULL, 0); - if (!sctxt) { - vshError(ctl, "%s", _("failed to create document saving context")); - goto cleanup; - } - - xmlSaveTree(sctxt, devices[indx]); - xmlSaveClose(sctxt); - *newXML = (char *) xmlBufferContent(buf); - if (!*newXML) { - virReportOOMError(); - goto cleanup; - } - buf->content = NULL; - } - - vshDebug(ctl, VSH_ERR_DEBUG, "Old xml:\n%s\nNew xml:\n%s\n", oldXML, - newXML ? NULLSTR(*newXML) : "(null)"); - - funcRet = 0; - -cleanup: - xmlBufferFree(buf); - VIR_FREE(devices); - xmlXPathFreeContext(devCtxt); - xmlXPathFreeContext(domCtxt); - xmlFreeDoc(devDoc); - xmlFreeDoc(domDoc); - VIR_FREE(domXML); - VIR_FREE(xpath); - return funcRet; -} - /* * "detach-device" command */ @@ -12835,11 +12589,10 @@ static const vshCmdOptDef opts_detach_device[] = { static bool cmdDetachDevice(vshControl *ctl, const vshCmd *cmd) { - virDomainPtr dom = NULL; + virDomainPtr dom; const char *from = NULL; - char *buffer = NULL, *new_buffer = NULL; + char *buffer; int ret; - bool funcRet = false; unsigned int flags; if (!vshConnectionUsability(ctl, ctl->conn)) @@ -12848,50 +12601,37 @@ cmdDetachDevice(vshControl *ctl, const vshCmd *cmd) if (!(dom = vshCommandOptDomain(ctl, cmd, NULL))) return false; - if (vshCommandOptString(cmd, "file", &from) <= 0) - goto cleanup; + if (vshCommandOptString(cmd, "file", &from) <= 0) { + virDomainFree(dom); + return false; + } if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { virshReportError(ctl); - goto cleanup; - } - - ret = vshCompleteXMLFromDomain(ctl, dom, buffer, &new_buffer); - if (ret < 0) { - if (ret == -2) { - vshError(ctl, _("no such device in %s"), virDomainGetName(dom)); - } else if (ret == -3) { - vshError(ctl, "%s", _("given XML selects too many devices. " - "Please, be more specific")); - } else { - /* vshCompleteXMLFromDomain() already printed error message, - * so nothing to do here. */ - } - goto cleanup; + virDomainFree(dom); + return false; } if (vshCommandOptBool(cmd, "persistent")) { flags = VIR_DOMAIN_AFFECT_CONFIG; if (virDomainIsActive(dom) == 1) flags |= VIR_DOMAIN_AFFECT_LIVE; - ret = virDomainDetachDeviceFlags(dom, new_buffer, flags); + ret = virDomainDetachDeviceFlags(dom, buffer, flags); } else { - ret = virDomainDetachDevice(dom, new_buffer); + ret = virDomainDetachDevice(dom, buffer); } + VIR_FREE(buffer); if (ret < 0) { vshError(ctl, _("Failed to detach device from %s"), from); - goto cleanup; + virDomainFree(dom); + return false; + } else { + vshPrint(ctl, "%s", _("Device detached successfully\n")); } - vshPrint(ctl, "%s", _("Device detached successfully\n")); - funcRet = true; - -cleanup: - VIR_FREE(new_buffer); - VIR_FREE(buffer); virDomainFree(dom); - return funcRet; + return true; } -- 1.7.7.3

2 2

[libvirt] [PATCH] nwfilter: fix typing error in filter
by Stefan Berger 11 Jan '12

11 Jan '12

Fix a typing error in the no-ip-spoofing filter. Return DHCP request packets passing through this filter. Have the user use another filter to actually allow DHCP requests to be sent (action='accept'). --- examples/xml/nwfilter/no-ip-spoofing.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) Index: libvirt-acl/examples/xml/nwfilter/no-ip-spoofing.xml =================================================================== --- libvirt-acl.orig/examples/xml/nwfilter/no-ip-spoofing.xml +++ libvirt-acl/examples/xml/nwfilter/no-ip-spoofing.xml @@ -1,7 +1,7 @@ <filter name='no-ip-spoofing' chain='ipv4-ip' priority='-710'> -  - <rule action='accept' direction='out' priority='100'> - <ip srcipaddr='0.0.0.0' protocol='udp' srcportstart='68' srcportend='68'/> +  + <rule action='return' direction='out' priority='100'> + <ip srcipaddr='0.0.0.0' protocol='udp' srcportstart='68' dstportstart='67'/> </rule>

2 2

[libvirt] blockJob events broken
by Adam Litke 11 Jan '12

11 Jan '12

Hi Dan, I noticed that since d09f6ba5feb655925175dc80122ca2a1e14db2b9, blockJob events are not being delivered to registered clients. I did verify that VM lifecycle events are still working fine though. I am confused why your patch has only affected my blockJob events. Do you have any ideas? -- Adam Litke <agl(a)us.ibm.com> IBM Linux Technology Center

1 0

[libvirt] [PATCH 3/3][TCK] nwfilter: test access via index and iterators
by Stefan Berger 11 Jan '12

11 Jan '12

Test access to variables using index and iterators --- scripts/nwfilter/nwfilterxml2fwallout/iter-test3.fwall | 37 +++++++++++++++++ scripts/nwfilter/nwfilterxml2xmlin/iter-test3.xml | 13 +++++ 2 files changed, 50 insertions(+) Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/iter-test3.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/iter-test3.fwall @@ -0,0 +1,37 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x01tcp spt:80 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x01tcp spt:90 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x02udp spt:80 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x02udp spt:90 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x01tcp dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x01tcp dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT udp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x02udp dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT udp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x02udp dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT sctp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x03sctp spt:1100 dpt:80 state ESTABLISHED ctdir ORIGINAL +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x01tcp spt:80 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x01tcp spt:90 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x02udp spt:80 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x02udp spt:90 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#iptables -L FORWARD -n --line-number | grep libvirt +1 libvirt-in all -- 0.0.0.0/0 0.0.0.0/0 +2 libvirt-out all -- 0.0.0.0/0 0.0.0.0/0 +3 libvirt-in-post all -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/iter-test3.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/iter-test3.xml @@ -0,0 +1,13 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <tcp srcipaddr='$A[ 0]' srcportstart='$B[ @0 ] ' dscp='1'/> + </rule> + <rule action='accept' direction='out'> + <udp srcipaddr='$A[1 ]' srcportstart='$B[ @2 ]' dscp='2'/> + </rule> + <rule action='accept' direction='out'> + <sctp srcipaddr='$A[ 1 ] ' srcportstart='$B[2 ] ' dstportstart='$C[ 2 ]' + dscp='3'/> + </rule> +</filter>

2 2

[libvirt] [PATCH] virsh: Two new fields for command domblklist
by Osier Yang 11 Jan '12

11 Jan '12

Disk "type" and "device" are generally interesting stuffs the user who wants to known too. Though it's likely breaks the script which parses the command output by field (e.g. awk), putting them in the head is better, as it coheres with the user's habit more. (Trying to find the small word (type, device) after a very long file path (could be) sounds not a good idea). --- tools/virsh.c | 14 +++++++++++--- tools/virsh.pod | 14 +++++++------- 2 files changed, 18 insertions(+), 10 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index 3af2fd7..31c2b5c 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -1905,7 +1905,7 @@ cmdDomblkinfo(vshControl *ctl, const vshCmd *cmd) */ static const vshCmdInfo info_domblklist[] = { {"help", N_("list all domain blocks")}, - {"desc", N_("Get the names of block devices for a domain.")}, + {"desc", N_("Get the summary of block devices for a domain.")}, {NULL, NULL} }; @@ -1950,14 +1950,19 @@ cmdDomblklist(vshControl *ctl, const vshCmd *cmd) if (ndisks < 0) goto cleanup; - vshPrint(ctl, "%-10s %s\n", _("Target"), _("Source")); + vshPrint(ctl, "%-10s %-10s %-10s %s\n", _("Type"), + _("Device"), _("Target"), _("Source")); vshPrint(ctl, "------------------------------------------------\n"); for (i = 0; i < ndisks; i++) { + char *type; + char *device; char *target; char *source; ctxt->node = disks[i]; + type = virXPathString("string(./@type)", ctxt); + device = virXPathString("string(./@device)", ctxt); target = virXPathString("string(./target/@dev)", ctxt); if (!target) { vshError(ctl, "unable to query block list"); @@ -1967,7 +1972,10 @@ cmdDomblklist(vshControl *ctl, const vshCmd *cmd) "|./source/@dev" "|./source/@dir" "|./source/@name)", ctxt); - vshPrint(ctl, "%-10s %s\n", target, source ? source : "-"); + vshPrint(ctl, "%-10s %-10s %-10s %s\n", type, device, + target, source ? source : "-"); + VIR_FREE(type); + VIR_FREE(device); VIR_FREE(target); VIR_FREE(source); } diff --git a/tools/virsh.pod b/tools/virsh.pod index bae6a13..6ae9a90 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -514,13 +514,13 @@ also B<domblklist> for listing these names). =item B<domblklist> I<domain> [I<--inactive>] -Print a table showing the names of all block devices associated with -I<domain>, as well as the path to the source of each device. If -I<--inactive> is specified, query the block devices that will be used -on the next boot, rather than those currently in use by a running -domain. Other contexts that require a block device name (such as -I<domblkinfo> or I<snapshot-create> for disk snapshots) will accept -either target or unique source names printed by this command. +Print a table showing the brief information of all block devices +associated with I<domain>. If I<--inactive> is specified, query the +block devices that will be used on the next boot, rather than those +currently in use by a running domain. Other contexts that require a +block device name (such as I<domblkinfo> or I<snapshot-create> for +disk snapshots) will accept either target or unique source names +printed by this command. =item B<domiflist> I<domain> [I<--inactive>] -- 1.7.7.3

2 1

[libvirt] [PATCH v2][TCK] add test for get and define save image xml
by Xiaoqiang Hu 11 Jan '12

11 Jan '12

v2: change save image path from working dir to libvirt-tck cache dir v1: add test for get and define save image xml and there are types of save image file covered in the test: persistent, transient and invalid domain save image --- scripts/qemu/400-save-image-xml.t | 107 +++++++++++++++++++++++++++++++++++++ 1 files changed, 107 insertions(+), 0 deletions(-) create mode 100644 scripts/qemu/400-save-image-xml.t diff --git a/scripts/qemu/400-save-image-xml.t b/scripts/qemu/400-save-image-xml.t new file mode 100644 index 0000000..a1430c7 --- /dev/null +++ b/scripts/qemu/400-save-image-xml.t @@ -0,0 +1,107 @@ +# -*- perl -*- +# +# Copyright (C) 2012-2013 Red Hat, Inc. +# Copyright (C) 2012-2013 Xiaoqiang Hu <xhu(a)redhat.com> +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +qemu/400-save-image-xml.t: test get and define xml from save image + +=head1 DESCRIPTION + +The test case validates that it is possible to define and get domain xml +from save image. There are three types of save image file covered in the +test: persistent, transient and invalid domain save image +=cut + +use strict; +use warnings; + +use Test::More tests => 10; + +use Sys::Virt::TCK; +use Test::Exception; +use File::Basename; + +my $tck = Sys::Virt::TCK->new(); +my $savefile = $tck->bucket_dir("400-save-image-xml")."/"."tck.img"; +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { + $tck->cleanup if $tck; + unlink $savefile if -f $savefile; +} + +SKIP:{ + skip "Only relevant to QEMU driver", 10 unless $conn->get_type() eq "QEMU"; + + # scenario 1 - get/define xml from transient domain save image + my $xml = $tck->generic_domain("tck")->as_xml; + diag "Creating a new transient domain"; + my $dom; + ok_domain(sub { $dom = $conn->create_domain($xml) }, "created transient domain object"); + + unlink $savefile if -f $savefile; + eval { $dom->save($savefile); }; + SKIP: { + skip "save/restore not implemented", 9 if $@ && err_not_implemented($@); + ok(!$@, "domain saved"); + die $@ if $@; + + my $savedxmldesc; + diag "Checking that transient domain has gone away"; + ok_error(sub { $conn->get_domain_by_name("tck") }, "NO_DOMAIN error raised from missing domain", + Sys::Virt::Error::ERR_NO_DOMAIN); + eval { $savedxmldesc = $conn->get_save_image_xml_description($savefile, 0); }; + SKIP: { + skip "get/define save img xml not implemented", 7 if $@ && err_not_implemented($@); + $savedxmldesc = $conn->get_save_image_xml_description($savefile, 0); + $savedxmldesc =~ s/destroy/restart/g; + $conn->define_save_image_xml($savefile, $savedxmldesc, 0); + + $savedxmldesc = $conn->get_save_image_xml_description($savefile, 0); + ok(!($savedxmldesc =~ m/destroy/), "the transient domain save image xml has been updated"); + + # scenario 2 - get/define xml from persistent domain save image + my $xml = $tck->generic_domain("tck")->as_xml; + diag "Creating a new persistent domain"; + ok_domain(sub { $dom = $conn->define_domain($xml) }, "created persistent domain object"); + + unlink $savefile if -f $savefile; + diag "Starting inactive domain"; + $dom->create; + + $dom->save($savefile); + diag "Checking that persistent domain is stopped"; + ok_domain(sub { $conn->get_domain_by_name("tck") }, "persistent domain is still there", "tck"); + is($dom->get_id, -1, "running domain with ID == -1"); + + $savedxmldesc = $conn->get_save_image_xml_description($savefile, 0); + $savedxmldesc =~ s/destroy/restart/g; + $conn->define_save_image_xml($savefile, $savedxmldesc, 0); + + $savedxmldesc = $conn->get_save_image_xml_description($savefile, 0); + ok(!($savedxmldesc =~ m/destroy/), "the persistent save image xml has been updated"); + + # scenario 3 - get/define xml from invalid domain save image + unlink $savefile if -f $savefile; + diag "Creating an invalid save img file"; + `dd if=/dev/null of=$savefile bs=1M count=100 >& /dev/null 2>&1`; + ok($? == 0, "created 100M raw img file: $savefile"); + diag "Getting xml from invalid save image"; + ok_error(sub { $conn->get_save_image_xml_description($savefile, 0) }, "failed to get invalid domain save image xml" ); + } + } +} +# end -- 1.7.1

3 2

[libvirt] [PATCH 1/1] Added check for maximum number of vcpus exceeding topology limit
by Martin Kletzander 11 Jan '12

11 Jan '12

Earlier, when the number of vcpus was greater than the topology allowed, libvirt didn't raise an error and continued, resulting in running qemu with parameters making no sense. Even though qemu did not report any error itself, the number of vcpus was set to maximum allowed by the topology. --- src/conf/domain_conf.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 180dd2b..06ddd02 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -8010,6 +8010,13 @@ static virDomainDefPtr virDomainDefParseXML(virCapsPtr caps, if (def->cpu == NULL) goto error; + if (def->maxvcpus > + def->cpu->sockets * def->cpu->cores * def->cpu->threads) { + virDomainReportError(VIR_ERR_XML_DETAIL, "%s", + _("Maximum CPUs greater than topology limit")); + goto error; + } + if (def->cpu->cells_cpus > def->maxvcpus) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Number of CPUs in <numa> exceeds the" -- 1.7.3.4

2 1

[libvirt] [PATCH] build: fix build on mingw with netcf available
by Eric Blake 11 Jan '12

11 Jan '12

The autobuilder pointed out an odd failure on mingw: ../../src/interface/netcf_driver.c:644:5: error: unknown field 'close_used_without_including_unistd_h' specified in initializer cc1: warnings being treated as errors This is because the gnulib headers #define close in order to work around some odd mingw problems with close(), but it happens to also affect field members declared with a name of struct foo.close. As long as the same headers are included for the definition and use of the struct, the #define doesn't matter, but the netcf file hit an instance where things were in a different order. Fix this for all clients that use a struct member named 'close'. * src/driver.h: Include <unistd.h> before using 'close'. --- I don't have netcf for mingw locally, so I'd like a review before pushing this, since I couldn't confirm whether it fixed the broken build on the autobuilder. src/driver.h | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/driver.h b/src/driver.h index ec4abf3..24636a4 100644 --- a/src/driver.h +++ b/src/driver.h @@ -8,6 +8,7 @@ # include "config.h" +# include <unistd.h> # include <libxml/uri.h> # include "internal.h" -- 1.7.7.5

2 2

[libvirt] [PATCH] Disable netcf if building without libvirtd
by Daniel P. Berrange 11 Jan '12

11 Jan '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> Although the netcf interface driver can in theory be used by the stateless drivers, in practice none of them want to use it because they have different ways of dealing with interfaces. Furthermore, if you have mingw32-netcf installed, then the libvirt mingw32 build will fail with ../../src/interface/netcf_driver.c:644:5: error: unknown field 'close_used_without_including_unistd_h' specified in initializer * configure.ac: disable netcf if built without libvirtd --- configure.ac | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/configure.ac b/configure.ac index b12e9fb..729ba9b 100644 --- a/configure.ac +++ b/configure.ac @@ -1613,6 +1613,9 @@ AC_ARG_WITH([netcf], NETCF_CFLAGS= NETCF_LIBS= +if test "$with_libvirtd" = "no" ; then + with_netcf=no +fi if test "$with_netcf" = "yes" || test "$with_netcf" = "check"; then PKG_CHECK_MODULES(NETCF, netcf >= $NETCF_REQUIRED, [with_netcf=yes], [ -- 1.7.7.5

2 1

[libvirt] [PATCH libvirt-glib] Add support for shutdown event to avoid console warnings
by Daniel P. Berrange 11 Jan '12

11 Jan '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> --- libvirt-gobject/libvirt-gobject-connection.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/libvirt-gobject/libvirt-gobject-connection.c b/libvirt-gobject/libvirt-gobject-connection.c index d5f9c45..f0c9ff6 100644 --- a/libvirt-gobject/libvirt-gobject-connection.c +++ b/libvirt-gobject/libvirt-gobject-connection.c @@ -376,6 +376,9 @@ static int domain_event_cb(virConnectPtr conn G_GNUC_UNUSED, } break; + case VIR_DOMAIN_EVENT_SHUTDOWN: + break; + default: g_warn_if_reached(); } -- 1.7.7.5

2 1

[libvirt] [PATCH libvirt-glib] Add support for configuring serial, parallel & channel devices
by Daniel P. Berrange 11 Jan '12

11 Jan '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> The basic config of serial, parallel & channel devices is just the same as console devices. Add basic stubs for these new devices --- libvirt-gconfig/Makefile.am | 6 ++ libvirt-gconfig/libvirt-gconfig-domain-channel.c | 70 +++++++++++++++++++++ libvirt-gconfig/libvirt-gconfig-domain-channel.h | 67 ++++++++++++++++++++ libvirt-gconfig/libvirt-gconfig-domain-parallel.c | 70 +++++++++++++++++++++ libvirt-gconfig/libvirt-gconfig-domain-parallel.h | 67 ++++++++++++++++++++ libvirt-gconfig/libvirt-gconfig-domain-serial.c | 70 +++++++++++++++++++++ libvirt-gconfig/libvirt-gconfig-domain-serial.h | 67 ++++++++++++++++++++ libvirt-gconfig/libvirt-gconfig.h | 3 + libvirt-gconfig/libvirt-gconfig.sym | 12 ++++ 9 files changed, 432 insertions(+), 0 deletions(-) create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-channel.c create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-channel.h create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-parallel.c create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-parallel.h create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-serial.c create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-serial.h diff --git a/libvirt-gconfig/Makefile.am b/libvirt-gconfig/Makefile.am index d542074..03a5507 100644 --- a/libvirt-gconfig/Makefile.am +++ b/libvirt-gconfig/Makefile.am @@ -13,6 +13,7 @@ GCONFIG_HEADER_FILES = \ libvirt-gconfig-object.h \ libvirt-gconfig-capabilities.h \ libvirt-gconfig-domain.h \ + libvirt-gconfig-domain-channel.h \ libvirt-gconfig-domain-chardev.h \ libvirt-gconfig-domain-chardev-source.h \ libvirt-gconfig-domain-chardev-source-pty.h \ @@ -32,7 +33,9 @@ GCONFIG_HEADER_FILES = \ libvirt-gconfig-domain-interface-user.h \ libvirt-gconfig-domain-memballoon.h \ libvirt-gconfig-domain-os.h \ + libvirt-gconfig-domain-parallel.h \ libvirt-gconfig-domain-seclabel.h \ + libvirt-gconfig-domain-serial.h \ libvirt-gconfig-domain-snapshot.h \ libvirt-gconfig-domain-sound.h \ libvirt-gconfig-domain-timer.h \ @@ -61,6 +64,7 @@ GCONFIG_SOURCE_FILES = \ libvirt-gconfig-main.c \ libvirt-gconfig-capabilities.c \ libvirt-gconfig-domain.c \ + libvirt-gconfig-domain-channel.c \ libvirt-gconfig-domain-chardev.c \ libvirt-gconfig-domain-chardev-source.c \ libvirt-gconfig-domain-chardev-source-pty.c \ @@ -80,7 +84,9 @@ GCONFIG_SOURCE_FILES = \ libvirt-gconfig-domain-interface-user.c \ libvirt-gconfig-domain-memballoon.c \ libvirt-gconfig-domain-os.c \ + libvirt-gconfig-domain-parallel.c \ libvirt-gconfig-domain-seclabel.c \ + libvirt-gconfig-domain-serial.c \ libvirt-gconfig-domain-snapshot.c \ libvirt-gconfig-domain-sound.c \ libvirt-gconfig-domain-timer.c \ diff --git a/libvirt-gconfig/libvirt-gconfig-domain-channel.c b/libvirt-gconfig/libvirt-gconfig-domain-channel.c new file mode 100644 index 0000000..a3134b4 --- /dev/null +++ b/libvirt-gconfig/libvirt-gconfig-domain-channel.c @@ -0,0 +1,70 @@ +/* + * libvirt-gconfig-domain-channel.c: libvirt domain channel configuration + * + * Copyright (C) 2011 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Daniel P. Berrange <berrange(a)redhat.com> + */ + +#include <config.h> + +#include "libvirt-gconfig/libvirt-gconfig.h" + +#define GVIR_CONFIG_DOMAIN_CHANNEL_GET_PRIVATE(obj) \ + (G_TYPE_INSTANCE_GET_PRIVATE((obj), GVIR_CONFIG_TYPE_DOMAIN_CHANNEL, GVirConfigDomainChannelPrivate)) + +struct _GVirConfigDomainChannelPrivate +{ + gboolean unused; +}; + +G_DEFINE_TYPE(GVirConfigDomainChannel, gvir_config_domain_channel, GVIR_CONFIG_TYPE_DOMAIN_CHARDEV); + + +static void gvir_config_domain_channel_class_init(GVirConfigDomainChannelClass *klass) +{ + g_type_class_add_private(klass, sizeof(GVirConfigDomainChannelPrivate)); +} + + +static void gvir_config_domain_channel_init(GVirConfigDomainChannel *channel) +{ + g_debug("Init GVirConfigDomainChannel=%p", channel); + + channel->priv = GVIR_CONFIG_DOMAIN_CHANNEL_GET_PRIVATE(channel); +} + +GVirConfigDomainChannel *gvir_config_domain_channel_new(void) +{ + GVirConfigObject *object; + + object = gvir_config_object_new(GVIR_CONFIG_TYPE_DOMAIN_CHANNEL, + "channel", NULL); + return GVIR_CONFIG_DOMAIN_CHANNEL(object); +} + +GVirConfigDomainChannel *gvir_config_domain_channel_new_from_xml(const gchar *xml, + GError **error) +{ + GVirConfigObject *object; + + object = gvir_config_object_new_from_xml(GVIR_CONFIG_TYPE_DOMAIN_CHANNEL, + "channel", NULL, xml, error); + if (object == NULL) + return NULL; + return GVIR_CONFIG_DOMAIN_CHANNEL(object); +} diff --git a/libvirt-gconfig/libvirt-gconfig-domain-channel.h b/libvirt-gconfig/libvirt-gconfig-domain-channel.h new file mode 100644 index 0000000..d2dc136 --- /dev/null +++ b/libvirt-gconfig/libvirt-gconfig-domain-channel.h @@ -0,0 +1,67 @@ +/* + * libvirt-gconfig-domain-channel.h: libvirt domain channel configuration + * + * Copyright (C) 2011 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Daniel P. Berrange <berrange(a)redhat.com> + */ + +#if !defined(__LIBVIRT_GCONFIG_H__) && !defined(LIBVIRT_GCONFIG_BUILD) +#error "Only <libvirt-gconfig/libvirt-gconfig.h> can be included directly." +#endif + +#ifndef __LIBVIRT_GCONFIG_DOMAIN_CHANNEL_H__ +#define __LIBVIRT_GCONFIG_DOMAIN_CHANNEL_H__ + +G_BEGIN_DECLS + +#define GVIR_CONFIG_TYPE_DOMAIN_CHANNEL (gvir_config_domain_channel_get_type ()) +#define GVIR_CONFIG_DOMAIN_CHANNEL(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GVIR_CONFIG_TYPE_DOMAIN_CHANNEL, GVirConfigDomainChannel)) +#define GVIR_CONFIG_DOMAIN_CHANNEL_CLASS(klass) (G_TYPE_CHECK_CLASS_CAST ((klass), GVIR_CONFIG_TYPE_DOMAIN_CHANNEL, GVirConfigDomainChannelClass)) +#define GVIR_CONFIG_IS_DOMAIN_CHANNEL(obj) (G_TYPE_CHECK_INSTANCE_TYPE ((obj), GVIR_CONFIG_TYPE_DOMAIN_CHANNEL)) +#define GVIR_CONFIG_IS_DOMAIN_CHANNEL_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), GVIR_CONFIG_TYPE_DOMAIN_CHANNEL)) +#define GVIR_CONFIG_DOMAIN_CHANNEL_GET_CLASS(obj) (G_TYPE_INSTANCE_GET_CLASS ((obj), GVIR_CONFIG_TYPE_DOMAIN_CHANNEL, GVirConfigDomainChannelClass)) + +typedef struct _GVirConfigDomainChannel GVirConfigDomainChannel; +typedef struct _GVirConfigDomainChannelPrivate GVirConfigDomainChannelPrivate; +typedef struct _GVirConfigDomainChannelClass GVirConfigDomainChannelClass; + +struct _GVirConfigDomainChannel +{ + GVirConfigDomainChardev parent; + + GVirConfigDomainChannelPrivate *priv; + + /* Do not add fields to this struct */ +}; + +struct _GVirConfigDomainChannelClass +{ + GVirConfigDomainChardevClass parent_class; + + gpointer padding[20]; +}; + + +GType gvir_config_domain_channel_get_type(void); +GVirConfigDomainChannel *gvir_config_domain_channel_new(void); +GVirConfigDomainChannel *gvir_config_domain_channel_new_from_xml(const gchar *xml, + GError **error); + +G_END_DECLS + +#endif /* __LIBVIRT_GCONFIG_DOMAIN_CHANNEL_H__ */ diff --git a/libvirt-gconfig/libvirt-gconfig-domain-parallel.c b/libvirt-gconfig/libvirt-gconfig-domain-parallel.c new file mode 100644 index 0000000..2f5ea52 --- /dev/null +++ b/libvirt-gconfig/libvirt-gconfig-domain-parallel.c @@ -0,0 +1,70 @@ +/* + * libvirt-gconfig-domain-parallel.c: libvirt domain parallel configuration + * + * Copyright (C) 2011 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Daniel P. Berrange <berrange(a)redhat.com> + */ + +#include <config.h> + +#include "libvirt-gconfig/libvirt-gconfig.h" + +#define GVIR_CONFIG_DOMAIN_PARALLEL_GET_PRIVATE(obj) \ + (G_TYPE_INSTANCE_GET_PRIVATE((obj), GVIR_CONFIG_TYPE_DOMAIN_PARALLEL, GVirConfigDomainParallelPrivate)) + +struct _GVirConfigDomainParallelPrivate +{ + gboolean unused; +}; + +G_DEFINE_TYPE(GVirConfigDomainParallel, gvir_config_domain_parallel, GVIR_CONFIG_TYPE_DOMAIN_CHARDEV); + + +static void gvir_config_domain_parallel_class_init(GVirConfigDomainParallelClass *klass) +{ + g_type_class_add_private(klass, sizeof(GVirConfigDomainParallelPrivate)); +} + + +static void gvir_config_domain_parallel_init(GVirConfigDomainParallel *parallel) +{ + g_debug("Init GVirConfigDomainParallel=%p", parallel); + + parallel->priv = GVIR_CONFIG_DOMAIN_PARALLEL_GET_PRIVATE(parallel); +} + +GVirConfigDomainParallel *gvir_config_domain_parallel_new(void) +{ + GVirConfigObject *object; + + object = gvir_config_object_new(GVIR_CONFIG_TYPE_DOMAIN_PARALLEL, + "parallel", NULL); + return GVIR_CONFIG_DOMAIN_PARALLEL(object); +} + +GVirConfigDomainParallel *gvir_config_domain_parallel_new_from_xml(const gchar *xml, + GError **error) +{ + GVirConfigObject *object; + + object = gvir_config_object_new_from_xml(GVIR_CONFIG_TYPE_DOMAIN_PARALLEL, + "parallel", NULL, xml, error); + if (object == NULL) + return NULL; + return GVIR_CONFIG_DOMAIN_PARALLEL(object); +} diff --git a/libvirt-gconfig/libvirt-gconfig-domain-parallel.h b/libvirt-gconfig/libvirt-gconfig-domain-parallel.h new file mode 100644 index 0000000..fd9c656 --- /dev/null +++ b/libvirt-gconfig/libvirt-gconfig-domain-parallel.h @@ -0,0 +1,67 @@ +/* + * libvirt-gconfig-domain-parallel.h: libvirt domain parallel configuration + * + * Copyright (C) 2011 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Daniel P. Berrange <berrange(a)redhat.com> + */ + +#if !defined(__LIBVIRT_GCONFIG_H__) && !defined(LIBVIRT_GCONFIG_BUILD) +#error "Only <libvirt-gconfig/libvirt-gconfig.h> can be included directly." +#endif + +#ifndef __LIBVIRT_GCONFIG_DOMAIN_PARALLEL_H__ +#define __LIBVIRT_GCONFIG_DOMAIN_PARALLEL_H__ + +G_BEGIN_DECLS + +#define GVIR_CONFIG_TYPE_DOMAIN_PARALLEL (gvir_config_domain_parallel_get_type ()) +#define GVIR_CONFIG_DOMAIN_PARALLEL(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GVIR_CONFIG_TYPE_DOMAIN_PARALLEL, GVirConfigDomainParallel)) +#define GVIR_CONFIG_DOMAIN_PARALLEL_CLASS(klass) (G_TYPE_CHECK_CLASS_CAST ((klass), GVIR_CONFIG_TYPE_DOMAIN_PARALLEL, GVirConfigDomainParallelClass)) +#define GVIR_CONFIG_IS_DOMAIN_PARALLEL(obj) (G_TYPE_CHECK_INSTANCE_TYPE ((obj), GVIR_CONFIG_TYPE_DOMAIN_PARALLEL)) +#define GVIR_CONFIG_IS_DOMAIN_PARALLEL_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), GVIR_CONFIG_TYPE_DOMAIN_PARALLEL)) +#define GVIR_CONFIG_DOMAIN_PARALLEL_GET_CLASS(obj) (G_TYPE_INSTANCE_GET_CLASS ((obj), GVIR_CONFIG_TYPE_DOMAIN_PARALLEL, GVirConfigDomainParallelClass)) + +typedef struct _GVirConfigDomainParallel GVirConfigDomainParallel; +typedef struct _GVirConfigDomainParallelPrivate GVirConfigDomainParallelPrivate; +typedef struct _GVirConfigDomainParallelClass GVirConfigDomainParallelClass; + +struct _GVirConfigDomainParallel +{ + GVirConfigDomainChardev parent; + + GVirConfigDomainParallelPrivate *priv; + + /* Do not add fields to this struct */ +}; + +struct _GVirConfigDomainParallelClass +{ + GVirConfigDomainChardevClass parent_class; + + gpointer padding[20]; +}; + + +GType gvir_config_domain_parallel_get_type(void); +GVirConfigDomainParallel *gvir_config_domain_parallel_new(void); +GVirConfigDomainParallel *gvir_config_domain_parallel_new_from_xml(const gchar *xml, + GError **error); + +G_END_DECLS + +#endif /* __LIBVIRT_GCONFIG_DOMAIN_PARALLEL_H__ */ diff --git a/libvirt-gconfig/libvirt-gconfig-domain-serial.c b/libvirt-gconfig/libvirt-gconfig-domain-serial.c new file mode 100644 index 0000000..89c54ba --- /dev/null +++ b/libvirt-gconfig/libvirt-gconfig-domain-serial.c @@ -0,0 +1,70 @@ +/* + * libvirt-gconfig-domain-serial.c: libvirt domain serial configuration + * + * Copyright (C) 2011 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Daniel P. Berrange <berrange(a)redhat.com> + */ + +#include <config.h> + +#include "libvirt-gconfig/libvirt-gconfig.h" + +#define GVIR_CONFIG_DOMAIN_SERIAL_GET_PRIVATE(obj) \ + (G_TYPE_INSTANCE_GET_PRIVATE((obj), GVIR_CONFIG_TYPE_DOMAIN_SERIAL, GVirConfigDomainSerialPrivate)) + +struct _GVirConfigDomainSerialPrivate +{ + gboolean unused; +}; + +G_DEFINE_TYPE(GVirConfigDomainSerial, gvir_config_domain_serial, GVIR_CONFIG_TYPE_DOMAIN_CHARDEV); + + +static void gvir_config_domain_serial_class_init(GVirConfigDomainSerialClass *klass) +{ + g_type_class_add_private(klass, sizeof(GVirConfigDomainSerialPrivate)); +} + + +static void gvir_config_domain_serial_init(GVirConfigDomainSerial *serial) +{ + g_debug("Init GVirConfigDomainSerial=%p", serial); + + serial->priv = GVIR_CONFIG_DOMAIN_SERIAL_GET_PRIVATE(serial); +} + +GVirConfigDomainSerial *gvir_config_domain_serial_new(void) +{ + GVirConfigObject *object; + + object = gvir_config_object_new(GVIR_CONFIG_TYPE_DOMAIN_SERIAL, + "serial", NULL); + return GVIR_CONFIG_DOMAIN_SERIAL(object); +} + +GVirConfigDomainSerial *gvir_config_domain_serial_new_from_xml(const gchar *xml, + GError **error) +{ + GVirConfigObject *object; + + object = gvir_config_object_new_from_xml(GVIR_CONFIG_TYPE_DOMAIN_SERIAL, + "serial", NULL, xml, error); + if (object == NULL) + return NULL; + return GVIR_CONFIG_DOMAIN_SERIAL(object); +} diff --git a/libvirt-gconfig/libvirt-gconfig-domain-serial.h b/libvirt-gconfig/libvirt-gconfig-domain-serial.h new file mode 100644 index 0000000..8fba59c --- /dev/null +++ b/libvirt-gconfig/libvirt-gconfig-domain-serial.h @@ -0,0 +1,67 @@ +/* + * libvirt-gconfig-domain-serial.h: libvirt domain serial configuration + * + * Copyright (C) 2011 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Daniel P. Berrange <berrange(a)redhat.com> + */ + +#if !defined(__LIBVIRT_GCONFIG_H__) && !defined(LIBVIRT_GCONFIG_BUILD) +#error "Only <libvirt-gconfig/libvirt-gconfig.h> can be included directly." +#endif + +#ifndef __LIBVIRT_GCONFIG_DOMAIN_SERIAL_H__ +#define __LIBVIRT_GCONFIG_DOMAIN_SERIAL_H__ + +G_BEGIN_DECLS + +#define GVIR_CONFIG_TYPE_DOMAIN_SERIAL (gvir_config_domain_serial_get_type ()) +#define GVIR_CONFIG_DOMAIN_SERIAL(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GVIR_CONFIG_TYPE_DOMAIN_SERIAL, GVirConfigDomainSerial)) +#define GVIR_CONFIG_DOMAIN_SERIAL_CLASS(klass) (G_TYPE_CHECK_CLASS_CAST ((klass), GVIR_CONFIG_TYPE_DOMAIN_SERIAL, GVirConfigDomainSerialClass)) +#define GVIR_CONFIG_IS_DOMAIN_SERIAL(obj) (G_TYPE_CHECK_INSTANCE_TYPE ((obj), GVIR_CONFIG_TYPE_DOMAIN_SERIAL)) +#define GVIR_CONFIG_IS_DOMAIN_SERIAL_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), GVIR_CONFIG_TYPE_DOMAIN_SERIAL)) +#define GVIR_CONFIG_DOMAIN_SERIAL_GET_CLASS(obj) (G_TYPE_INSTANCE_GET_CLASS ((obj), GVIR_CONFIG_TYPE_DOMAIN_SERIAL, GVirConfigDomainSerialClass)) + +typedef struct _GVirConfigDomainSerial GVirConfigDomainSerial; +typedef struct _GVirConfigDomainSerialPrivate GVirConfigDomainSerialPrivate; +typedef struct _GVirConfigDomainSerialClass GVirConfigDomainSerialClass; + +struct _GVirConfigDomainSerial +{ + GVirConfigDomainChardev parent; + + GVirConfigDomainSerialPrivate *priv; + + /* Do not add fields to this struct */ +}; + +struct _GVirConfigDomainSerialClass +{ + GVirConfigDomainChardevClass parent_class; + + gpointer padding[20]; +}; + + +GType gvir_config_domain_serial_get_type(void); +GVirConfigDomainSerial *gvir_config_domain_serial_new(void); +GVirConfigDomainSerial *gvir_config_domain_serial_new_from_xml(const gchar *xml, + GError **error); + +G_END_DECLS + +#endif /* __LIBVIRT_GCONFIG_DOMAIN_SERIAL_H__ */ diff --git a/libvirt-gconfig/libvirt-gconfig.h b/libvirt-gconfig/libvirt-gconfig.h index 7176400..cb28e23 100644 --- a/libvirt-gconfig/libvirt-gconfig.h +++ b/libvirt-gconfig/libvirt-gconfig.h @@ -33,6 +33,7 @@ #include <libvirt-gconfig/libvirt-gconfig-domain-chardev.h> #include <libvirt-gconfig/libvirt-gconfig-domain-chardev-source.h> #include <libvirt-gconfig/libvirt-gconfig-domain-chardev-source-pty.h> +#include <libvirt-gconfig/libvirt-gconfig-domain-channel.h> #include <libvirt-gconfig/libvirt-gconfig-domain-clock.h> #include <libvirt-gconfig/libvirt-gconfig-domain-console.h> #include <libvirt-gconfig/libvirt-gconfig-domain-device.h> @@ -49,7 +50,9 @@ #include <libvirt-gconfig/libvirt-gconfig-domain-interface-user.h> #include <libvirt-gconfig/libvirt-gconfig-domain-memballoon.h> #include <libvirt-gconfig/libvirt-gconfig-domain-os.h> +#include <libvirt-gconfig/libvirt-gconfig-domain-parallel.h> #include <libvirt-gconfig/libvirt-gconfig-domain-seclabel.h> +#include <libvirt-gconfig/libvirt-gconfig-domain-serial.h> #include <libvirt-gconfig/libvirt-gconfig-domain-snapshot.h> #include <libvirt-gconfig/libvirt-gconfig-domain-sound.h> #include <libvirt-gconfig/libvirt-gconfig-domain-timer.h> diff --git a/libvirt-gconfig/libvirt-gconfig.sym b/libvirt-gconfig/libvirt-gconfig.sym index 8a47418..7cf3c3d 100644 --- a/libvirt-gconfig/libvirt-gconfig.sym +++ b/libvirt-gconfig/libvirt-gconfig.sym @@ -30,6 +30,10 @@ LIBVIRT_GCONFIG_0.0.3 { gvir_config_domain_set_virt_type; gvir_config_domain_virt_type_get_type; + gvir_config_domain_channel_get_type; + gvir_config_domain_channel_new; + gvir_config_domain_channel_new_from_xml; + gvir_config_domain_chardev_get_type; gvir_config_domain_chardev_set_source; @@ -168,6 +172,10 @@ LIBVIRT_GCONFIG_0.0.3 { gvir_config_domain_os_set_arch; gvir_config_domain_os_type_get_type; + gvir_config_domain_parallel_get_type; + gvir_config_domain_parallel_new; + gvir_config_domain_parallel_new_from_xml; + gvir_config_domain_seclabel_get_type; gvir_config_domain_seclabel_type_get_type; gvir_config_domain_seclabel_new; @@ -177,6 +185,10 @@ LIBVIRT_GCONFIG_0.0.3 { gvir_config_domain_seclabel_set_baselabel; gvir_config_domain_seclabel_set_label; + gvir_config_domain_serial_get_type; + gvir_config_domain_serial_new; + gvir_config_domain_serial_new_from_xml; + gvir_config_domain_snapshot_get_type; gvir_config_domain_snapshot_new; gvir_config_domain_snapshot_new_from_xml; -- 1.7.7.5

2 1

[libvirt] ALERT Virtualization Automatic Builder
by berrange＠redhat.com 11 Jan '12

11 Jan '12

Overall status: failed Start date: Tue Jan 10 2012 Start time: 18:05:04 UTC / 13:05:04 EST Build counter: 1326218704 Build timestamp: 1326218704 URL: http://builder.virt-tools.org/index.html Module: libvirt Status: failed URL: http://builder.virt-tools.org/module-libvirt.html

3 2

[libvirt] [PATCH] build: avoid spurious compiler warning
by Eric Blake 11 Jan '12

11 Jan '12

For some weird reason, i686-pc-mingw32-gcc version 4.6.1 at -O2 complained: ../../src/conf/nwfilter_params.c: In function 'virNWFilterVarCombIterCreate': ../../src/conf/nwfilter_params.c:346:23: error: 'minValue' may be used uninitialized in this function [-Werror=uninitialized] ../../src/conf/nwfilter_params.c:319:28: note: 'minValue' was declared here ../../src/conf/nwfilter_params.c:344:23: error: 'maxValue' may be used uninitialized in this function [-Werror=uninitialized] ../../src/conf/nwfilter_params.c:319:18: note: 'maxValue' was declared here cc1: all warnings being treated as errors even though all paths of the preceding switch statement either assign the variables or return. * src/conf/nwfilter_params.c (virNWFilterVarCombIterAddVariable): Initialize variables. --- Pushing under the build-breaker rule. src/conf/nwfilter_params.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/conf/nwfilter_params.c b/src/conf/nwfilter_params.c index 8949b95..7400fa0 100644 --- a/src/conf/nwfilter_params.c +++ b/src/conf/nwfilter_params.c @@ -1,7 +1,7 @@ /* * nwfilter_params.c: parsing and data maintenance of filter parameters * - * Copyright (C) 2011 Red Hat, Inc. + * Copyright (C) 2011-2012 Red Hat, Inc. * Copyright (C) 2010 IBM Corporation * * This library is free software; you can redistribute it and/or @@ -316,7 +316,7 @@ virNWFilterVarCombIterAddVariable(virNWFilterVarCombIterEntryPtr cie, const virNWFilterVarAccessPtr varAccess) { virNWFilterVarValuePtr varValue; - unsigned int maxValue, minValue; + unsigned int maxValue = 0, minValue = 0; const char *varName = virNWFilterVarAccessGetVarName(varAccess); varValue = virHashLookup(hash->hashTable, varName); -- 1.7.7.5

1 0

[libvirt] [BUG, PATCH-RFC] libvirt localtime and rtc_timeoffset handling in xen-sexpr/sxpr/sxp
by Philipp Hahn 11 Jan '12

11 Jan '12

Hello, I'm currently tracking a problem in libvirt regarding Xens handling of localtime and rtc_timeoffset. My current understanding (Xen-3.4.3 and Xen-4.1.2 under Linux) of Xend (the depcrecated Python one still used by libvirt) is as this: - for HV domains, the RTC gets setup to either UTC or localtime depending on "/domain/image/hvm/localtime" ± "/domain/image/hvm/rtc_offset". - if the OS of a domU changes its RTC, the rtc_offset gets adjusted and is saved in XenStore as "/vm/$UUID/rtc/timeoffset". - if the dom0 accesses its RTC, is accesses the real HW-RTC. - the Xen-Hypervisor initially read the HW-RTC to setup its Wallclock once, which is than used to simulate the domU RTCs. (The HW-RTC is otherwise only accessed on (ACPI-)Suspend and Resume, and with NTP-drift-correction from dom0). - on shut-down the rtc_offset is stored by Xend in the "/var/lib/xend/domains/$uuid/config.sxp" file in "/domain/image/hvm/rtc_timeoffset", from where it is loaded again on next start. - since PV domains don't have a RTC, they somehow(?) get either initialized to the localtime or UTC time depending on "/domain/image/linux/localtime". @xen: Did I figure out that correct? @xen: Is there some documentation on the Xen-sxp domain configuration? For the Python based xen-xm format, I found (and updated) <http://wiki.xen.org/wiki/XenConfigurationFileOptions>, but for Xen-sxp I so far found no documentation, especially on what changed between xen-1, xen-2, xen-3.x, xen-4.x. @libvirt: Comparing Xend handling to <http://libvirt.org/formatdomain.html#elementsTime> the current translation done by libvirt looks wrong; I think is mandates back to the time when Xen supported only PV-domUs: libvirt translates the Xen configuration to "localtime" and "utc" ignoring the "rtc_offset", which exists for HV domains. For localtime=0 this translates to libvirts offset="variable"-case, but for localtime=1 there is no matching mapping in libvirt. Since for PV domains no rtc_timeoffset is tracked, there the mapping to "utc" and "localtime" looks right. For libvirt there was a patch <http://www.redhat.com/archives/libvir-list/2009-January/msg00757.html> which added some special handling for "localtime" to be either placed in "/domain/localtime" or "/domain/image/{hvm,linux}/localtime". Xend from 3.4.3 und 4.1.2 seems to accept either one, but /domain/image/hvm/localtime is preferred and overwrites the first one. When reading back the configuration the setting is always returned as /domain/image/{hvm,linux}/localtime. @John: Is there a case, where /domain/localtime is returned or is that key always translated to /domain/linux/{hvm,linux}/localtime? As you had a sun.com email address, was this some special case when using Xen with Solaris? @libvirt: The attached patch (for 0.8.7) would change the implementation to match the following: 1. For Xen-PV-domUs, use clock/@offset='utc' and clock/@offset='localtime'. 2. For Xen-HV-domUs, use clock/@offset='variable'. 3. For backward compatibility with old libvirt-XML-files convert clock/@offset='utc' → (localtime 0)(rtc_timeoffset 0) and clock/@offset='localtime' → (localtime 1)(rtc_timeosset 0). On readback that will be returned as clock/@offset='variable'! 4. For Xen-HV-domUs with (localtime=1)(rtc_timeoffset≠0) print a warning that there is no mapping to libvirts XML. 5. Always put the (localtime)(rtc_offset)-SEXPRs in "(image ({linux,hvm})", since this is where Xend-3.4 and Xend-4.1 return them. I also checked Xen-3.2, where this is okay, but the I don't have any older versions of Xen available (and running), the I can't verify that it still works there. Which leads me to a another question: Which versions of Xen are still supported by libvirt (and must be checked for regressions)? I don't want so actively remove the code for old Xen versions, but it gets harder and harder to maintain all those versions. So a statement like "Xen-3.x and Xen-4.y are actively supported by libvirt-0.a.b; older versions might still work (by accident ;-)" Before I forward-port that change to 0.9.10 I'd like to get some comments. Thanks in advance. Sincerely Philipp Hahn -- Philipp Hahn Open Source Software Engineer hahn(a)univention.de Univention GmbH Linux for Your Business fon: +49 421 22 232- 0 Mary-Somerville-Str.1 D-28359 Bremen fax: +49 421 22 232-99 http://www.univention.de/

2 2

[libvirt] ALERT Virtualization Automatic Builder
by berrange＠redhat.com 11 Jan '12

11 Jan '12

Overall status: failed Start date: Wed Jan 11 2012 Start time: 11:29:22 UTC / 06:29:22 EST Build counter: 1326281362 Build timestamp: 1326281362 URL: http://builder.virt-tools.org/index.html Module: libvirt Status: failed URL: http://builder.virt-tools.org/module-libvirt.html

1 0

[libvirt] [PATCH 2/3][TCK] nwfilter: test access via iterators
by Stefan Berger 11 Jan '12

11 Jan '12

Test access to variables using different iterators. --- scripts/nwfilter/nwfilter2vmtest.sh | 6 scripts/nwfilter/nwfilterxml2fwallout/iter-test2.fwall | 193 +++++++++++++++++ scripts/nwfilter/nwfilterxml2xmlin/iter-test2.xml | 23 ++ 3 files changed, 222 insertions(+) Index: libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh =================================================================== --- libvirt-tck.orig/scripts/nwfilter/nwfilter2vmtest.sh +++ libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh @@ -348,9 +348,15 @@ createVM() { <parameter name='A' value='1.1.1.1'/> <parameter name='A' value='2.2.2.2'/> <parameter name='A' value='3.3.3.3'/> + <parameter name='A' value='3.3.3.3'/> <parameter name='B' value='80'/> <parameter name='B' value='90'/> <parameter name='B' value='80'/> + <parameter name='B' value='80'/> + <parameter name='C' value='1080'/> + <parameter name='C' value='1090'/> + <parameter name='C' value='1100'/> + <parameter name='C' value='1110'/> </filterref> <target dev='${vmname}'/> </interface> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/iter-test2.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/iter-test2.fwall @@ -0,0 +1,193 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x01tcp spt:80 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x01tcp spt:90 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x01tcp spt:80 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x02udp spt:80 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x02udp spt:80 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x02udp spt:80 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x02udp spt:90 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x02udp spt:90 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x02udp spt:90 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x03sctp spt:90 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x03sctp spt:90 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x03sctp spt:90 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 1.1.1.1 1.1.1.1 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 2.2.2.2 1.1.1.1 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 3.3.3.3 1.1.1.1 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 1.1.1.1 2.2.2.2 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 2.2.2.2 2.2.2.2 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 3.3.3.3 2.2.2.2 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 1.1.1.1 3.3.3.3 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 2.2.2.2 3.3.3.3 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 3.3.3.3 3.3.3.3 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 1.1.1.1 1.1.1.1 DSCP match 0x06state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 2.2.2.2 2.2.2.2 DSCP match 0x06state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 3.3.3.3 3.3.3.3 DSCP match 0x06state NEW,ESTABLISHED ctdir REPLY +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x01tcp dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x01tcp dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 3.3.3.3 DSCP match 0x01tcp dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT udp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x02udp dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT udp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x02udp dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT udp -- 0.0.0.0/0 3.3.3.3 DSCP match 0x02udp dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT udp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x02udp dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT udp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x02udp dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT udp -- 0.0.0.0/0 3.3.3.3 DSCP match 0x02udp dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT sctp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x03sctp spt:1080 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT sctp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x03sctp spt:1080 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT sctp -- 0.0.0.0/0 3.3.3.3 DSCP match 0x03sctp spt:1080 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT sctp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x03sctp spt:1090 dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT sctp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x03sctp spt:1090 dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT sctp -- 0.0.0.0/0 3.3.3.3 DSCP match 0x03sctp spt:1090 dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT sctp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x03sctp spt:1100 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT sctp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x03sctp spt:1100 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT sctp -- 0.0.0.0/0 3.3.3.3 DSCP match 0x03sctp spt:1100 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT sctp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x03sctp spt:1110 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT sctp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x03sctp spt:1110 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT sctp -- 0.0.0.0/0 3.3.3.3 DSCP match 0x03sctp spt:1110 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x04tcp spt:1080 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x04tcp spt:1080 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 3.3.3.3 DSCP match 0x04tcp spt:1080 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x04tcp spt:1080 dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x04tcp spt:1080 dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 3.3.3.3 DSCP match 0x04tcp spt:1080 dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x04tcp spt:1090 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x04tcp spt:1090 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 3.3.3.3 DSCP match 0x04tcp spt:1090 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x04tcp spt:1090 dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x04tcp spt:1090 dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 3.3.3.3 DSCP match 0x04tcp spt:1090 dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x04tcp spt:1100 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x04tcp spt:1100 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 3.3.3.3 DSCP match 0x04tcp spt:1100 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x04tcp spt:1100 dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x04tcp spt:1100 dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 3.3.3.3 DSCP match 0x04tcp spt:1100 dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x04tcp spt:1110 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x04tcp spt:1110 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 3.3.3.3 DSCP match 0x04tcp spt:1110 dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x04tcp spt:1110 dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x04tcp spt:1110 dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 3.3.3.3 DSCP match 0x04tcp spt:1110 dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT udp -- 1.1.1.1 1.1.1.1 DSCP match 0x05state ESTABLISHED ctdir ORIGINAL +ACCEPT udp -- 1.1.1.1 2.2.2.2 DSCP match 0x05state ESTABLISHED ctdir ORIGINAL +ACCEPT udp -- 1.1.1.1 3.3.3.3 DSCP match 0x05state ESTABLISHED ctdir ORIGINAL +ACCEPT udp -- 2.2.2.2 1.1.1.1 DSCP match 0x05state ESTABLISHED ctdir ORIGINAL +ACCEPT udp -- 2.2.2.2 2.2.2.2 DSCP match 0x05state ESTABLISHED ctdir ORIGINAL +ACCEPT udp -- 2.2.2.2 3.3.3.3 DSCP match 0x05state ESTABLISHED ctdir ORIGINAL +ACCEPT udp -- 3.3.3.3 1.1.1.1 DSCP match 0x05state ESTABLISHED ctdir ORIGINAL +ACCEPT udp -- 3.3.3.3 2.2.2.2 DSCP match 0x05state ESTABLISHED ctdir ORIGINAL +ACCEPT udp -- 3.3.3.3 3.3.3.3 DSCP match 0x05state ESTABLISHED ctdir ORIGINAL +ACCEPT sctp -- 1.1.1.1 1.1.1.1 DSCP match 0x06state ESTABLISHED ctdir ORIGINAL +ACCEPT sctp -- 2.2.2.2 2.2.2.2 DSCP match 0x06state ESTABLISHED ctdir ORIGINAL +ACCEPT sctp -- 3.3.3.3 3.3.3.3 DSCP match 0x06state ESTABLISHED ctdir ORIGINAL +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x01tcp spt:80 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x01tcp spt:90 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x01tcp spt:80 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x02udp spt:80 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x02udp spt:80 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x02udp spt:80 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x02udp spt:90 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x02udp spt:90 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x02udp spt:90 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x03sctp spt:90 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x03sctp spt:90 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x03sctp spt:90 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x03sctp spt:80 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1080 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1090 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1100 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x04tcp spt:80 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x04tcp spt:90 dpt:1110 state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 1.1.1.1 1.1.1.1 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 2.2.2.2 1.1.1.1 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 3.3.3.3 1.1.1.1 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 1.1.1.1 2.2.2.2 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 2.2.2.2 2.2.2.2 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 3.3.3.3 2.2.2.2 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 1.1.1.1 3.3.3.3 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 2.2.2.2 3.3.3.3 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN udp -- 3.3.3.3 3.3.3.3 DSCP match 0x05state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 1.1.1.1 1.1.1.1 DSCP match 0x06state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 2.2.2.2 2.2.2.2 DSCP match 0x06state NEW,ESTABLISHED ctdir REPLY +RETURN sctp -- 3.3.3.3 3.3.3.3 DSCP match 0x06state NEW,ESTABLISHED ctdir REPLY +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#iptables -L FORWARD -n --line-number | grep libvirt +1 libvirt-in all -- 0.0.0.0/0 0.0.0.0/0 +2 libvirt-out all -- 0.0.0.0/0 0.0.0.0/0 +3 libvirt-in-post all -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/iter-test2.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/iter-test2.xml @@ -0,0 +1,23 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <tcp srcipaddr='$A' srcportstart='$B[@0]' dscp='1'/> + </rule> + <rule action='accept' direction='out'> + <udp srcipaddr='$A[@1]' srcportstart='$B[@2]' dscp='2'/> + </rule> + <rule action='accept' direction='out'> + <sctp srcipaddr='$A[@1]' srcportstart='$B[@2]' dstportstart='$C[@2]' + dscp='3'/> + </rule> + <rule action='accept' direction='out'> + <tcp srcipaddr='$A[@1]' srcportstart='$B[@2]' dstportstart='$C[@3]' + dscp='4'/> + </rule> + <rule action='accept' direction='out'> + <udp srcipaddr='$A[@1]' dstipaddr='$A[@2]' dscp='5'/> + </rule> + <rule action='accept' direction='out'> + <sctp srcipaddr='$A' dstipaddr='$A' dscp='6'/> + </rule> +</filter>

1 0

[libvirt] [PATCH 1/3][TCK] nwfilter: test access to 2 lists in one rule
by Stefan Berger 11 Jan '12

11 Jan '12

Test access to 2 lists in one rule --- scripts/nwfilter/nwfilter2vmtest.sh | 6 +++ scripts/nwfilter/nwfilterxml2fwallout/iter-test1.fwall | 31 +++++++++++++++++ scripts/nwfilter/nwfilterxml2xmlin/iter-test1.xml | 6 +++ 3 files changed, 43 insertions(+) Index: libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh =================================================================== --- libvirt-tck.orig/scripts/nwfilter/nwfilter2vmtest.sh +++ libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh @@ -345,6 +345,12 @@ createVM() { <source bridge='virbr0'/> <filterref filter='${filtername}'> <parameter name='IP' value='${ipaddr}'/> + <parameter name='A' value='1.1.1.1'/> + <parameter name='A' value='2.2.2.2'/> + <parameter name='A' value='3.3.3.3'/> + <parameter name='B' value='80'/> + <parameter name='B' value='90'/> + <parameter name='B' value='80'/> </filterref> <target dev='${vmname}'/> </interface> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/iter-test1.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/iter-test1.fwall @@ -0,0 +1,31 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x02tcp spt:80 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x02tcp spt:90 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x02tcp spt:80 state NEW,ESTABLISHED ctdir REPLY +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 0.0.0.0/0 1.1.1.1 DSCP match 0x02tcp dpt:80 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 2.2.2.2 DSCP match 0x02tcp dpt:90 state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp -- 0.0.0.0/0 3.3.3.3 DSCP match 0x02tcp dpt:80 state ESTABLISHED ctdir ORIGINAL +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 1.1.1.1 0.0.0.0/0 DSCP match 0x02tcp spt:80 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 2.2.2.2 0.0.0.0/0 DSCP match 0x02tcp spt:90 state NEW,ESTABLISHED ctdir REPLY +RETURN tcp -- 3.3.3.3 0.0.0.0/0 DSCP match 0x02tcp spt:80 state NEW,ESTABLISHED ctdir REPLY +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#iptables -L FORWARD -n --line-number | grep libvirt +1 libvirt-in all -- 0.0.0.0/0 0.0.0.0/0 +2 libvirt-out all -- 0.0.0.0/0 0.0.0.0/0 +3 libvirt-in-post all -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/iter-test1.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/iter-test1.xml @@ -0,0 +1,6 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <tcp srcipaddr='$A' srcportstart='$B' dscp='2'/> + </rule> +</filter>

1 0

[libvirt] [PATCH v2 0/6] nwfilter: Enable access to variables via iterator or index
by Stefan Berger 11 Jan '12

11 Jan '12

This patch enables access to variables in filters using indep. iterators ($TEST[$@2]) or via index ($TEST[1]). Three test cases are added that are also being used for libvirt-TCK to check that the instantiation of the filtering rules is correct. v1 -> v2: - addressed Eric Blake's comments Regards, Stefan

2 9

[libvirt] [PATCH] virsh: improve doMigrate function docs
by ajia＠redhat.com 11 Jan '12

11 Jan '12

From: Alex Jia <ajia(a)redhat.com> When running virsh migrate with --xml option and actual xml file doesn't exist, virsh hasn't output any error information, although return value is 1. * tools/virsh.c: Raising a appropriate error information when operation fails. * How to reproduce? % virsh migrate <domain> --live qemu+ssh://<target host>/system --xml non-existent.xml % echo $? * Fixed result: error: file 'non-existent.xml' doesn't exist Signed-off-by: Alex Jia <ajia(a)redhat.com> --- tools/virsh.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index e4b812e..020e7b5 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -6338,9 +6338,10 @@ doMigrate (void *opaque) flags |= VIR_MIGRATE_CHANGE_PROTECTION; if (xmlfile && - virFileReadAll(xmlfile, 8192, &xml) < 0) + virFileReadAll(xmlfile, 8192, &xml) < 0) { + vshError(ctl, _("file '%s' doesn't exist"), xmlfile); goto out; - + } if ((flags & VIR_MIGRATE_PEER2PEER) || vshCommandOptBool (cmd, "direct")) { -- 1.7.1

2 1

[libvirt] [PATCH] Change security driver APIs to use virDomainDefPtr instead of virDomainObjPtr
by Daniel P. Berrange 11 Jan '12

11 Jan '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> When sVirt is integrated with the LXC driver, it will be neccessary to invoke the security driver APIs using only a virDomainDefPtr since the lxc_container.c code has no virDomainObjPtr available. Aside from two functions which want obj->pid, every bit of the security driver code only touches obj->def. So we don't need to pass a virDomainObjPtr into the security drivers, a virDomainDefPtr is sufficient. Two functions also gain a 'pid_t pid' argument. * src/qemu/qemu_driver.c, src/qemu/qemu_hotplug.c, src/qemu/qemu_migration.c, src/qemu/qemu_process.c, src/security/security_apparmor.c, src/security/security_dac.c, src/security/security_driver.h, src/security/security_manager.c, src/security/security_manager.h, src/security/security_nop.c, src/security/security_selinux.c, src/security/security_stack.c: Change all security APIs to use a virDomainDefPtr instead of virDomainObjPtr --- src/qemu/qemu_driver.c | 10 +- src/qemu/qemu_hotplug.c | 28 ++-- src/qemu/qemu_migration.c | 12 +- src/qemu/qemu_process.c | 24 ++-- src/security/security_apparmor.c | 136 ++++++++++---------- src/security/security_dac.c | 91 +++++++------- src/security/security_driver.h | 36 +++--- src/security/security_manager.c | 40 +++--- src/security/security_manager.h | 36 +++--- src/security/security_nop.c | 36 +++--- src/security/security_selinux.c | 260 +++++++++++++++++++------------------- src/security/security_stack.c | 44 ++++--- 12 files changed, 381 insertions(+), 372 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 6cfdd1d..6e001ce 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -3096,7 +3096,7 @@ qemuDomainScreenshot(virDomainPtr dom, } unlink_tmp = true; - virSecurityManagerSetSavedStateLabel(qemu_driver->securityManager, vm, tmp); + virSecurityManagerSetSavedStateLabel(qemu_driver->securityManager, vm->def, tmp); qemuDomainObjEnterMonitor(driver, vm); if (qemuMonitorScreendump(priv->mon, tmp) < 0) { @@ -3868,7 +3868,7 @@ static int qemudDomainGetSecurityLabel(virDomainPtr dom, virSecurityLabelPtr sec */ if (virDomainObjIsActive(vm)) { if (virSecurityManagerGetProcessLabel(driver->securityManager, - vm, seclabel) < 0) { + vm->def, vm->pid, seclabel) < 0) { qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Failed to get security label")); goto cleanup; @@ -4167,7 +4167,7 @@ qemuDomainSaveImageStartVM(virConnectPtr conn, out: virCommandFree(cmd); if (virSecurityManagerRestoreSavedStateLabel(driver->securityManager, - vm, path) < 0) + vm->def, path) < 0) VIR_WARN("failed to restore save state label on %s", path); return ret; @@ -7584,7 +7584,7 @@ qemudDomainMemoryPeek (virDomainPtr dom, goto endjob; } - virSecurityManagerSetSavedStateLabel(qemu_driver->securityManager, vm, tmp); + virSecurityManagerSetSavedStateLabel(qemu_driver->securityManager, vm->def, tmp); priv = vm->privateData; qemuDomainObjEnterMonitor(driver, vm); @@ -9064,7 +9064,7 @@ qemuDomainSnapshotCreateSingleDiskActive(struct qemud_driver *driver, if (virDomainLockDiskAttach(driver->lockManager, vm, disk) < 0) goto cleanup; - if (virSecurityManagerSetImageLabel(driver->securityManager, vm, + if (virSecurityManagerSetImageLabel(driver->securityManager, vm->def, disk) < 0) { if (virDomainLockDiskDetach(driver->lockManager, vm, disk) < 0) VIR_WARN("Unable to release lock on %s", source); diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 96c0070..684fede 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -88,7 +88,7 @@ int qemuDomainChangeEjectableMedia(struct qemud_driver *driver, return -1; if (virSecurityManagerSetImageLabel(driver->securityManager, - vm, disk) < 0) { + vm->def, disk) < 0) { if (virDomainLockDiskDetach(driver->lockManager, vm, disk) < 0) VIR_WARN("Unable to release lock on %s", disk->src); return -1; @@ -120,7 +120,7 @@ int qemuDomainChangeEjectableMedia(struct qemud_driver *driver, goto error; if (virSecurityManagerRestoreImageLabel(driver->securityManager, - vm, origdisk) < 0) + vm->def, origdisk) < 0) VIR_WARN("Unable to restore security label on ejected image %s", origdisk->src); if (virDomainLockDiskDetach(driver->lockManager, vm, origdisk) < 0) @@ -141,7 +141,7 @@ error: VIR_FREE(driveAlias); if (virSecurityManagerRestoreImageLabel(driver->securityManager, - vm, disk) < 0) + vm->def, disk) < 0) VIR_WARN("Unable to restore security label on new media %s", disk->src); if (virDomainLockDiskDetach(driver->lockManager, vm, disk) < 0) @@ -209,7 +209,7 @@ int qemuDomainAttachPciDiskDevice(virConnectPtr conn, return -1; if (virSecurityManagerSetImageLabel(driver->securityManager, - vm, disk) < 0) { + vm->def, disk) < 0) { if (virDomainLockDiskDetach(driver->lockManager, vm, disk) < 0) VIR_WARN("Unable to release lock on %s", disk->src); return -1; @@ -283,7 +283,7 @@ error: VIR_WARN("Unable to release PCI address on %s", disk->src); if (virSecurityManagerRestoreImageLabel(driver->securityManager, - vm, disk) < 0) + vm->def, disk) < 0) VIR_WARN("Unable to restore security label on %s", disk->src); if (virDomainLockDiskDetach(driver->lockManager, vm, disk) < 0) @@ -439,7 +439,7 @@ int qemuDomainAttachSCSIDisk(virConnectPtr conn, return -1; if (virSecurityManagerSetImageLabel(driver->securityManager, - vm, disk) < 0) { + vm->def, disk) < 0) { if (virDomainLockDiskDetach(driver->lockManager, vm, disk) < 0) VIR_WARN("Unable to release lock on %s", disk->src); return -1; @@ -530,7 +530,7 @@ error: VIR_FREE(drivestr); if (virSecurityManagerRestoreImageLabel(driver->securityManager, - vm, disk) < 0) + vm->def, disk) < 0) VIR_WARN("Unable to restore security label on %s", disk->src); if (virDomainLockDiskDetach(driver->lockManager, vm, disk) < 0) @@ -562,7 +562,7 @@ int qemuDomainAttachUsbMassstorageDevice(virConnectPtr conn, return -1; if (virSecurityManagerSetImageLabel(driver->securityManager, - vm, disk) < 0) { + vm->def, disk) < 0) { if (virDomainLockDiskDetach(driver->lockManager, vm, disk) < 0) VIR_WARN("Unable to release lock on %s", disk->src); return -1; @@ -623,7 +623,7 @@ error: VIR_FREE(drivestr); if (virSecurityManagerRestoreImageLabel(driver->securityManager, - vm, disk) < 0) + vm->def, disk) < 0) VIR_WARN("Unable to restore security label on %s", disk->src); if (virDomainLockDiskDetach(driver->lockManager, vm, disk) < 0) @@ -1112,7 +1112,7 @@ int qemuDomainAttachHostDevice(struct qemud_driver *driver, if (virSecurityManagerSetHostdevLabel(driver->securityManager, - vm, hostdev) < 0) + vm->def, hostdev) < 0) return -1; switch (hostdev->source.subsys.type) { @@ -1139,7 +1139,7 @@ int qemuDomainAttachHostDevice(struct qemud_driver *driver, error: if (virSecurityManagerRestoreHostdevLabel(driver->securityManager, - vm, hostdev) < 0) + vm->def, hostdev) < 0) VIR_WARN("Unable to restore host device labelling on hotplug fail"); return -1; @@ -1572,7 +1572,7 @@ int qemuDomainDetachPciDiskDevice(struct qemud_driver *driver, virDomainDiskDefFree(detach); if (virSecurityManagerRestoreImageLabel(driver->securityManager, - vm, dev->data.disk) < 0) + vm->def, dev->data.disk) < 0) VIR_WARN("Unable to restore security label on %s", dev->data.disk->src); if (cgroup != NULL) { @@ -1654,7 +1654,7 @@ int qemuDomainDetachDiskDevice(struct qemud_driver *driver, virDomainDiskDefFree(detach); if (virSecurityManagerRestoreImageLabel(driver->securityManager, - vm, dev->data.disk) < 0) + vm->def, dev->data.disk) < 0) VIR_WARN("Unable to restore security label on %s", dev->data.disk->src); if (cgroup != NULL) { @@ -2162,7 +2162,7 @@ int qemuDomainDetachHostDevice(struct qemud_driver *driver, } if (virSecurityManagerRestoreHostdevLabel(driver->securityManager, - vm, dev->data.hostdev) < 0) + vm->def, dev->data.hostdev) < 0) VIR_WARN("Failed to restore host device labelling"); return ret; diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 8ae989a..b3ef894 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -1749,13 +1749,13 @@ static int doNativeMigrate(struct qemud_driver *driver, virReportOOMError(); goto cleanup; } - if (virSecurityManagerSetSocketLabel(driver->securityManager, vm) < 0) + if (virSecurityManagerSetSocketLabel(driver->securityManager, vm->def) < 0) goto cleanup; if (virNetSocketNewConnectTCP(uribits->server, tmp, &sock) == 0) { spec.dest.fd.qemu = virNetSocketDupFD(sock, true); virNetSocketFree(sock); } - if (virSecurityManagerClearSocketLabel(driver->securityManager, vm) < 0 || + if (virSecurityManagerClearSocketLabel(driver->securityManager, vm->def) < 0 || spec.dest.fd.qemu == -1) goto cleanup; } else { @@ -1822,7 +1822,7 @@ static int doTunnelMigrate(struct qemud_driver *driver, spec.dest.fd.local = fds[0]; } if (spec.dest.fd.qemu == -1 || - virSecurityManagerSetImageFDLabel(driver->securityManager, vm, + virSecurityManagerSetImageFDLabel(driver->securityManager, vm->def, spec.dest.fd.qemu) < 0) { virReportSystemError(errno, "%s", _("cannot create pipe for tunnelled migration")); @@ -2842,7 +2842,7 @@ qemuMigrationToFile(struct qemud_driver *driver, virDomainObjPtr vm, * doesn't have to open() the file, so while we still have to * grant SELinux access, we can do it on fd and avoid cleanup * later, as well as skip futzing with cgroup. */ - if (virSecurityManagerSetImageFDLabel(driver->securityManager, vm, + if (virSecurityManagerSetImageFDLabel(driver->securityManager, vm->def, compressor ? pipeFD[1] : fd) < 0) goto cleanup; bypassSecurityDriver = true; @@ -2876,7 +2876,7 @@ qemuMigrationToFile(struct qemud_driver *driver, virDomainObjPtr vm, } if ((!bypassSecurityDriver) && virSecurityManagerSetSavedStateLabel(driver->securityManager, - vm, path) < 0) + vm->def, path) < 0) goto cleanup; restoreLabel = true; } @@ -2951,7 +2951,7 @@ cleanup: virCommandFree(cmd); if (restoreLabel && (!bypassSecurityDriver) && virSecurityManagerRestoreSavedStateLabel(driver->securityManager, - vm, path) < 0) + vm->def, path) < 0) VIR_WARN("failed to restore save state label on %s", path); if (cgroup != NULL) { diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 2563f97..58ce333 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -839,7 +839,7 @@ qemuConnectMonitor(struct qemud_driver *driver, virDomainObjPtr vm) qemuMonitorPtr mon = NULL; if (virSecurityManagerSetDaemonSocketLabel(driver->securityManager, - vm) < 0) { + vm->def) < 0) { VIR_ERROR(_("Failed to set security context for monitor for %s"), vm->def->name); goto error; @@ -872,7 +872,7 @@ qemuConnectMonitor(struct qemud_driver *driver, virDomainObjPtr vm) } priv->mon = mon; - if (virSecurityManagerClearSocketLabel(driver->securityManager, vm) < 0) { + if (virSecurityManagerClearSocketLabel(driver->securityManager, vm->def) < 0) { VIR_ERROR(_("Failed to clear security context for monitor for %s"), vm->def->name); goto error; @@ -2163,7 +2163,7 @@ static int qemuProcessHook(void *data) * sockets the lock driver opens that we don't want * labelled. So far we're ok though. */ - if (virSecurityManagerSetSocketLabel(h->driver->securityManager, h->vm) < 0) + if (virSecurityManagerSetSocketLabel(h->driver->securityManager, h->vm->def) < 0) goto cleanup; if (virDomainLockProcessStart(h->driver->lockManager, h->vm, @@ -2171,7 +2171,7 @@ static int qemuProcessHook(void *data) true, &fd) < 0) goto cleanup; - if (virSecurityManagerClearSocketLabel(h->driver->securityManager, h->vm) < 0) + if (virSecurityManagerClearSocketLabel(h->driver->securityManager, h->vm->def) < 0) goto cleanup; if (qemuProcessLimits(h->driver) < 0) @@ -2194,7 +2194,7 @@ static int qemuProcessHook(void *data) return -1; VIR_DEBUG("Setting up security labelling"); - if (virSecurityManagerSetProcessLabel(h->driver->securityManager, h->vm) < 0) + if (virSecurityManagerSetProcessLabel(h->driver->securityManager, h->vm->def) < 0) goto cleanup; ret = 0; @@ -2656,7 +2656,7 @@ qemuProcessReconnect(void *opaque) goto error; } - if (virSecurityManagerReserveLabel(driver->securityManager, obj) < 0) + if (virSecurityManagerReserveLabel(driver->securityManager, obj->def, obj->pid) < 0) goto error; if (qemuProcessNotifyNets(obj->def) < 0) @@ -2894,7 +2894,7 @@ int qemuProcessStart(virConnectPtr conn, /* If you are using a SecurityDriver with dynamic labelling, then generate a security label for isolation */ VIR_DEBUG("Generating domain security label (if required)"); - if (virSecurityManagerGenLabel(driver->securityManager, vm) < 0) { + if (virSecurityManagerGenLabel(driver->securityManager, vm->def) < 0) { virDomainAuditSecurityLabel(vm, false); goto cleanup; } @@ -3128,7 +3128,7 @@ int qemuProcessStart(virConnectPtr conn, VIR_DEBUG("Setting domain security labels"); if (virSecurityManagerSetAllLabel(driver->securityManager, - vm, stdin_path) < 0) + vm->def, stdin_path) < 0) goto cleanup; if (stdin_fd != -1) { @@ -3145,7 +3145,7 @@ int qemuProcessStart(virConnectPtr conn, goto cleanup; } if (S_ISFIFO(stdin_sb.st_mode) && - virSecurityManagerSetImageFDLabel(driver->securityManager, vm, stdin_fd) < 0) + virSecurityManagerSetImageFDLabel(driver->securityManager, vm->def, stdin_fd) < 0) goto cleanup; } @@ -3398,8 +3398,8 @@ void qemuProcessStop(struct qemud_driver *driver, /* Reset Security Labels */ virSecurityManagerRestoreAllLabel(driver->securityManager, - vm, migrated); - virSecurityManagerReleaseLabel(driver->securityManager, vm); + vm->def, migrated); + virSecurityManagerReleaseLabel(driver->securityManager, vm->def); /* Clear out dynamically assigned labels */ if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC) { @@ -3548,7 +3548,7 @@ int qemuProcessAttach(virConnectPtr conn ATTRIBUTE_UNUSED, if (VIR_ALLOC(seclabel) < 0) goto no_memory; if (virSecurityManagerGetProcessLabel(driver->securityManager, - vm, seclabel) < 0) + vm->def, vm->pid, seclabel) < 0) goto cleanup; if (!(vm->def->seclabel.model = strdup(driver->caps->host.secModel.model))) goto no_memory; diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index 299dcc6..4848d85 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -47,7 +47,7 @@ /* Data structure to pass to *FileIterate so we have everything we need */ struct SDPDOP { virSecurityManagerPtr mgr; - virDomainObjPtr vm; + virDomainDefPtr def; }; /* @@ -159,7 +159,7 @@ profile_status_file(const char *str) static int load_profile(virSecurityManagerPtr mgr, const char *profile, - virDomainObjPtr vm, + virDomainDefPtr def, const char *fn, bool append) { @@ -170,7 +170,7 @@ load_profile(virSecurityManagerPtr mgr, const char *probe = virSecurityManagerGetAllowDiskFormatProbing(mgr) ? "1" : "0"; - xml = virDomainDefFormat(vm->def, VIR_DOMAIN_XML_SECURE); + xml = virDomainDefFormat(def, VIR_DOMAIN_XML_SECURE); if (!xml) goto clean; @@ -212,12 +212,12 @@ remove_profile(const char *profile) } static char * -get_profile_name(virDomainObjPtr vm) +get_profile_name(virDomainDefPtr def) { char uuidstr[VIR_UUID_STRING_BUFLEN]; char *name = NULL; - virUUIDFormat(vm->def->uuid, uuidstr); + virUUIDFormat(def->uuid, uuidstr); if (virAsprintf(&name, "%s%s", AA_PREFIX, uuidstr) < 0) { virReportOOMError(); return NULL; @@ -257,23 +257,23 @@ cleanup: */ static int reload_profile(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, const char *fn, bool append) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; int rc = -1; char *profile_name = NULL; if (secdef->norelabel) return 0; - if ((profile_name = get_profile_name(vm)) == NULL) + if ((profile_name = get_profile_name(def)) == NULL) return rc; /* Update the profile only if it is loaded */ if (profile_loaded(secdef->imagelabel) >= 0) { - if (load_profile(mgr, secdef->imagelabel, vm, fn, append) < 0) { + if (load_profile(mgr, secdef->imagelabel, def, fn, append) < 0) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("cannot update AppArmor profile " "\'%s\'"), @@ -294,10 +294,10 @@ AppArmorSetSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED, const char *file, void *opaque) { struct SDPDOP *ptr = opaque; - virDomainObjPtr vm = ptr->vm; + virDomainDefPtr def = ptr->def; - if (reload_profile(ptr->mgr, vm, file, true) < 0) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + if (reload_profile(ptr->mgr, def, file, true) < 0) { + const virSecurityLabelDefPtr secdef = &def->seclabel; virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("cannot update AppArmor profile " "\'%s\'"), @@ -312,10 +312,10 @@ AppArmorSetSecurityPCILabel(pciDevice *dev ATTRIBUTE_UNUSED, const char *file, void *opaque) { struct SDPDOP *ptr = opaque; - virDomainObjPtr vm = ptr->vm; + virDomainDefPtr def = ptr->def; - if (reload_profile(ptr->mgr, vm, file, true) < 0) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + if (reload_profile(ptr->mgr, def, file, true) < 0) { + const virSecurityLabelDefPtr secdef = &def->seclabel; virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("cannot update AppArmor profile " "\'%s\'"), @@ -390,56 +390,56 @@ AppArmorSecurityManagerGetDOI(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED) */ static int AppArmorGenSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm) + virDomainDefPtr def) { int rc = -1; char *profile_name = NULL; - if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_STATIC) + if (def->seclabel.type == VIR_DOMAIN_SECLABEL_STATIC) return 0; - if (vm->def->seclabel.baselabel) { + if (def->seclabel.baselabel) { virSecurityReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("Cannot set a base label with AppArmour")); return rc; } - if ((vm->def->seclabel.label) || - (vm->def->seclabel.model) || (vm->def->seclabel.imagelabel)) { + if ((def->seclabel.label) || + (def->seclabel.model) || (def->seclabel.imagelabel)) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("security label already defined for VM")); return rc; } - if ((profile_name = get_profile_name(vm)) == NULL) + if ((profile_name = get_profile_name(def)) == NULL) return rc; - vm->def->seclabel.label = strndup(profile_name, strlen(profile_name)); - if (!vm->def->seclabel.label) { + def->seclabel.label = strndup(profile_name, strlen(profile_name)); + if (!def->seclabel.label) { virReportOOMError(); goto clean; } /* set imagelabel the same as label (but we won't use it) */ - vm->def->seclabel.imagelabel = strndup(profile_name, + def->seclabel.imagelabel = strndup(profile_name, strlen(profile_name)); - if (!vm->def->seclabel.imagelabel) { + if (!def->seclabel.imagelabel) { virReportOOMError(); goto err; } - vm->def->seclabel.model = strdup(SECURITY_APPARMOR_NAME); - if (!vm->def->seclabel.model) { + def->seclabel.model = strdup(SECURITY_APPARMOR_NAME); + if (!def->seclabel.model) { virReportOOMError(); goto err; } /* Now that we have a label, load the profile into the kernel. */ - if (load_profile(mgr, vm->def->seclabel.label, vm, NULL, false) < 0) { + if (load_profile(mgr, def->seclabel.label, def, NULL, false) < 0) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("cannot load AppArmor profile " - "\'%s\'"), vm->def->seclabel.label); + "\'%s\'"), def->seclabel.label); goto err; } @@ -447,9 +447,9 @@ AppArmorGenSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, goto clean; err: - VIR_FREE(vm->def->seclabel.label); - VIR_FREE(vm->def->seclabel.imagelabel); - VIR_FREE(vm->def->seclabel.model); + VIR_FREE(def->seclabel.label); + VIR_FREE(def->seclabel.imagelabel); + VIR_FREE(def->seclabel.model); clean: VIR_FREE(profile_name); @@ -459,15 +459,15 @@ AppArmorGenSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, static int AppArmorSetSecurityAllLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, const char *stdin_path) + virDomainDefPtr def, const char *stdin_path) { - if (vm->def->seclabel.norelabel) + if (def->seclabel.norelabel) return 0; /* Reload the profile if stdin_path is specified. Note that GenSecurityLabel() will have already been run. */ if (stdin_path) - return reload_profile(mgr, vm, stdin_path, true); + return reload_profile(mgr, def, stdin_path, true); return 0; } @@ -477,13 +477,14 @@ AppArmorSetSecurityAllLabel(virSecurityManagerPtr mgr, */ static int AppArmorGetSecurityProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm, + virDomainDefPtr def, + pid_t pid, virSecurityLabelPtr sec) { int rc = -1; char *profile_name = NULL; - if ((profile_name = get_profile_name(vm)) == NULL) + if ((profile_name = get_profile_name(def)) == NULL) return rc; if (virStrcpy(sec->label, profile_name, @@ -511,9 +512,9 @@ AppArmorGetSecurityProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, */ static int AppArmorReleaseSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm) + virDomainDefPtr def) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; VIR_FREE(secdef->model); VIR_FREE(secdef->label); @@ -525,10 +526,10 @@ AppArmorReleaseSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, static int AppArmorRestoreSecurityAllLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm, + virDomainDefPtr def, int migrated ATTRIBUTE_UNUSED) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; int rc = 0; if (secdef->type == VIR_DOMAIN_SECLABEL_DYNAMIC) { @@ -545,13 +546,13 @@ AppArmorRestoreSecurityAllLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, * LOCALSTATEDIR/log/libvirt/qemu/<vm name>.log */ static int -AppArmorSetSecurityProcessLabel(virSecurityManagerPtr mgr, virDomainObjPtr vm) +AppArmorSetSecurityProcessLabel(virSecurityManagerPtr mgr, virDomainDefPtr def) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; int rc = -1; char *profile_name = NULL; - if ((profile_name = get_profile_name(vm)) == NULL) + if ((profile_name = get_profile_name(def)) == NULL) return rc; if (STRNEQ(virSecurityManagerGetModel(mgr), secdef->model)) { @@ -579,21 +580,21 @@ AppArmorSetSecurityProcessLabel(virSecurityManagerPtr mgr, virDomainObjPtr vm) static int AppArmorSetSecurityDaemonSocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED) + virDomainDefPtr vm ATTRIBUTE_UNUSED) { return 0; } static int AppArmorSetSecuritySocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED) + virDomainDefPtr def ATTRIBUTE_UNUSED) { return 0; } static int AppArmorClearSecuritySocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED) + virDomainDefPtr def ATTRIBUTE_UNUSED) { return 0; } @@ -602,18 +603,18 @@ AppArmorClearSecuritySocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, /* Called when hotplugging */ static int AppArmorRestoreSecurityImageLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, virDomainDiskDefPtr disk ATTRIBUTE_UNUSED) { - return reload_profile(mgr, vm, NULL, false); + return reload_profile(mgr, def, NULL, false); } /* Called when hotplugging */ static int AppArmorSetSecurityImageLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, virDomainDiskDefPtr disk) + virDomainDefPtr def, virDomainDiskDefPtr disk) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; int rc = -1; char *profile_name; @@ -631,12 +632,12 @@ AppArmorSetSecurityImageLabel(virSecurityManagerPtr mgr, return rc; } - if ((profile_name = get_profile_name(vm)) == NULL) + if ((profile_name = get_profile_name(def)) == NULL) return rc; /* update the profile only if it is loaded */ if (profile_loaded(secdef->imagelabel) >= 0) { - if (load_profile(mgr, secdef->imagelabel, vm, disk->src, + if (load_profile(mgr, secdef->imagelabel, def, disk->src, false) < 0) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("cannot update AppArmor profile " @@ -673,7 +674,8 @@ AppArmorSecurityVerify(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, static int AppArmorReserveSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED) + virDomainDefPtr def ATTRIBUTE_UNUSED, + pid_t pid ATTRIBUTE_UNUSED) { /* NOOP. Nothing to reserve with AppArmor */ return 0; @@ -681,11 +683,11 @@ AppArmorReserveSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, static int AppArmorSetSecurityHostdevLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, virDomainHostdevDefPtr dev) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; struct SDPDOP *ptr; int ret = -1; @@ -701,7 +703,7 @@ AppArmorSetSecurityHostdevLabel(virSecurityManagerPtr mgr, if (VIR_ALLOC(ptr) < 0) return -1; ptr->mgr = mgr; - ptr->vm = vm; + ptr->def = def; switch (dev->source.subsys.type) { case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB: { @@ -743,44 +745,44 @@ done: static int AppArmorRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, virDomainHostdevDefPtr dev ATTRIBUTE_UNUSED) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; if (secdef->norelabel) return 0; - return reload_profile(mgr, vm, NULL, false); + return reload_profile(mgr, def, NULL, false); } static int AppArmorSetSavedStateLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, const char *savefile) { - return reload_profile(mgr, vm, savefile, true); + return reload_profile(mgr, def, savefile, true); } static int AppArmorRestoreSavedStateLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, const char *savefile ATTRIBUTE_UNUSED) { - return reload_profile(mgr, vm, NULL, false); + return reload_profile(mgr, def, NULL, false); } static int AppArmorSetImageFDLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, int fd) { int rc = -1; char *proc = NULL; char *fd_path = NULL; - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; if (secdef->imagelabel == NULL) return 0; @@ -796,7 +798,7 @@ AppArmorSetImageFDLabel(virSecurityManagerPtr mgr, return rc; } - return reload_profile(mgr, vm, fd_path, true); + return reload_profile(mgr, def, fd_path, true); } virSecurityDriver virAppArmorSecurityDriver = { diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 0e75319..9c0017b 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -171,7 +171,7 @@ virSecurityDACSetSecurityFileLabel(virDomainDiskDefPtr disk ATTRIBUTE_UNUSED, static int virSecurityDACSetSecurityImageLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDefPtr def ATTRIBUTE_UNUSED, virDomainDiskDefPtr disk) { @@ -190,7 +190,7 @@ virSecurityDACSetSecurityImageLabel(virSecurityManagerPtr mgr, static int virSecurityDACRestoreSecurityImageLabelInt(virSecurityManagerPtr mgr, - virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDefPtr def ATTRIBUTE_UNUSED, virDomainDiskDefPtr disk, int migrated) { @@ -235,10 +235,10 @@ virSecurityDACRestoreSecurityImageLabelInt(virSecurityManagerPtr mgr, static int virSecurityDACRestoreSecurityImageLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, virDomainDiskDefPtr disk) { - return virSecurityDACRestoreSecurityImageLabelInt(mgr, vm, disk, 0); + return virSecurityDACRestoreSecurityImageLabelInt(mgr, def, disk, 0); } @@ -268,7 +268,7 @@ virSecurityDACSetSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED, static int virSecurityDACSetSecurityHostdevLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDefPtr def ATTRIBUTE_UNUSED, virDomainHostdevDefPtr dev) { virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); @@ -338,7 +338,7 @@ virSecurityDACRestoreSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED, static int virSecurityDACRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDefPtr def ATTRIBUTE_UNUSED, virDomainHostdevDefPtr dev) { @@ -489,7 +489,7 @@ virSecurityDACRestoreChardevCallback(virDomainDefPtr def ATTRIBUTE_UNUSED, static int virSecurityDACRestoreSecurityAllLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, int migrated) { virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); @@ -501,34 +501,34 @@ virSecurityDACRestoreSecurityAllLabel(virSecurityManagerPtr mgr, VIR_DEBUG("Restoring security label on %s migrated=%d", - vm->def->name, migrated); + def->name, migrated); - for (i = 0 ; i < vm->def->nhostdevs ; i++) { + for (i = 0 ; i < def->nhostdevs ; i++) { if (virSecurityDACRestoreSecurityHostdevLabel(mgr, - vm, - vm->def->hostdevs[i]) < 0) + def, + def->hostdevs[i]) < 0) rc = -1; } - for (i = 0 ; i < vm->def->ndisks ; i++) { + for (i = 0 ; i < def->ndisks ; i++) { if (virSecurityDACRestoreSecurityImageLabelInt(mgr, - vm, - vm->def->disks[i], + def, + def->disks[i], migrated) < 0) rc = -1; } - if (virDomainChrDefForeach(vm->def, + if (virDomainChrDefForeach(def, false, virSecurityDACRestoreChardevCallback, mgr) < 0) rc = -1; - if (vm->def->os.kernel && - virSecurityDACRestoreSecurityFileLabel(vm->def->os.kernel) < 0) + if (def->os.kernel && + virSecurityDACRestoreSecurityFileLabel(def->os.kernel) < 0) rc = -1; - if (vm->def->os.initrd && - virSecurityDACRestoreSecurityFileLabel(vm->def->os.initrd) < 0) + if (def->os.initrd && + virSecurityDACRestoreSecurityFileLabel(def->os.initrd) < 0) rc = -1; return rc; @@ -548,7 +548,7 @@ virSecurityDACSetChardevCallback(virDomainDefPtr def ATTRIBUTE_UNUSED, static int virSecurityDACSetSecurityAllLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, const char *stdin_path ATTRIBUTE_UNUSED) { virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); @@ -557,36 +557,36 @@ virSecurityDACSetSecurityAllLabel(virSecurityManagerPtr mgr, if (!priv->dynamicOwnership) return 0; - for (i = 0 ; i < vm->def->ndisks ; i++) { + for (i = 0 ; i < def->ndisks ; i++) { /* XXX fixme - we need to recursively label the entire tree :-( */ - if (vm->def->disks[i]->type == VIR_DOMAIN_DISK_TYPE_DIR) + if (def->disks[i]->type == VIR_DOMAIN_DISK_TYPE_DIR) continue; if (virSecurityDACSetSecurityImageLabel(mgr, - vm, - vm->def->disks[i]) < 0) + def, + def->disks[i]) < 0) return -1; } - for (i = 0 ; i < vm->def->nhostdevs ; i++) { + for (i = 0 ; i < def->nhostdevs ; i++) { if (virSecurityDACSetSecurityHostdevLabel(mgr, - vm, - vm->def->hostdevs[i]) < 0) + def, + def->hostdevs[i]) < 0) return -1; } - if (virDomainChrDefForeach(vm->def, + if (virDomainChrDefForeach(def, true, virSecurityDACSetChardevCallback, mgr) < 0) return -1; - if (vm->def->os.kernel && - virSecurityDACSetOwnership(vm->def->os.kernel, + if (def->os.kernel && + virSecurityDACSetOwnership(def->os.kernel, priv->user, priv->group) < 0) return -1; - if (vm->def->os.initrd && - virSecurityDACSetOwnership(vm->def->os.initrd, + if (def->os.initrd && + virSecurityDACSetOwnership(def->os.initrd, priv->user, priv->group) < 0) return -1; @@ -597,7 +597,7 @@ virSecurityDACSetSecurityAllLabel(virSecurityManagerPtr mgr, static int virSecurityDACSetSavedStateLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDefPtr def ATTRIBUTE_UNUSED, const char *savefile) { virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); @@ -608,7 +608,7 @@ virSecurityDACSetSavedStateLabel(virSecurityManagerPtr mgr, static int virSecurityDACRestoreSavedStateLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDefPtr def ATTRIBUTE_UNUSED, const char *savefile) { virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); @@ -622,11 +622,11 @@ virSecurityDACRestoreSavedStateLabel(virSecurityManagerPtr mgr, static int virSecurityDACSetProcessLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm ATTRIBUTE_UNUSED) + virDomainDefPtr def ATTRIBUTE_UNUSED) { virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); - VIR_DEBUG("Dropping privileges of VM to %u:%u", + VIR_DEBUG("Dropping privileges of DEF to %u:%u", (unsigned int) priv->user, (unsigned int) priv->group); if (virSetUIDGID(priv->user, priv->group) < 0) @@ -645,28 +645,30 @@ virSecurityDACVerify(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, static int virSecurityDACGenLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED) + virDomainDefPtr def ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDACReleaseLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED) + virDomainDefPtr def ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDACReserveLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED) + virDomainDefPtr def ATTRIBUTE_UNUSED, + pid_t pid ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDACGetProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDefPtr def ATTRIBUTE_UNUSED, + pid_t pid ATTRIBUTE_UNUSED, virSecurityLabelPtr seclabel ATTRIBUTE_UNUSED) { return 0; @@ -674,7 +676,7 @@ virSecurityDACGetProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, static int virSecurityDACSetDaemonSocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED) + virDomainDefPtr vm ATTRIBUTE_UNUSED) { return 0; } @@ -682,7 +684,7 @@ virSecurityDACSetDaemonSocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, static int virSecurityDACSetSocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED) + virDomainDefPtr def ATTRIBUTE_UNUSED) { return 0; } @@ -690,20 +692,19 @@ virSecurityDACSetSocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, static int virSecurityDACClearSocketLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED) + virDomainDefPtr def ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDACSetImageFDLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDefPtr def ATTRIBUTE_UNUSED, int fd ATTRIBUTE_UNUSED) { return 0; } - virSecurityDriver virSecurityDriverDAC = { sizeof(virSecurityDACData), "virDAC", diff --git a/src/security/security_driver.h b/src/security/security_driver.h index aea90b0..f0ace1c 100644 --- a/src/security/security_driver.h +++ b/src/security/security_driver.h @@ -39,50 +39,52 @@ typedef const char *(*virSecurityDriverGetModel) (virSecurityManagerPtr mgr); typedef const char *(*virSecurityDriverGetDOI) (virSecurityManagerPtr mgr); typedef int (*virSecurityDomainRestoreImageLabel) (virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, virDomainDiskDefPtr disk); typedef int (*virSecurityDomainSetDaemonSocketLabel)(virSecurityManagerPtr mgr, - virDomainObjPtr vm); + virDomainDefPtr vm); typedef int (*virSecurityDomainSetSocketLabel) (virSecurityManagerPtr mgr, - virDomainObjPtr vm); + virDomainDefPtr def); typedef int (*virSecurityDomainClearSocketLabel)(virSecurityManagerPtr mgr, - virDomainObjPtr vm); + virDomainDefPtr def); typedef int (*virSecurityDomainSetImageLabel) (virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, virDomainDiskDefPtr disk); typedef int (*virSecurityDomainRestoreHostdevLabel) (virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, virDomainHostdevDefPtr dev); typedef int (*virSecurityDomainSetHostdevLabel) (virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, virDomainHostdevDefPtr dev); typedef int (*virSecurityDomainSetSavedStateLabel) (virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, const char *savefile); typedef int (*virSecurityDomainRestoreSavedStateLabel) (virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, const char *savefile); typedef int (*virSecurityDomainGenLabel) (virSecurityManagerPtr mgr, - virDomainObjPtr sec); + virDomainDefPtr sec); typedef int (*virSecurityDomainReserveLabel) (virSecurityManagerPtr mgr, - virDomainObjPtr sec); + virDomainDefPtr sec, + pid_t pid); typedef int (*virSecurityDomainReleaseLabel) (virSecurityManagerPtr mgr, - virDomainObjPtr sec); + virDomainDefPtr sec); typedef int (*virSecurityDomainSetAllLabel) (virSecurityManagerPtr mgr, - virDomainObjPtr sec, + virDomainDefPtr sec, const char *stdin_path); typedef int (*virSecurityDomainRestoreAllLabel) (virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, int migrated); typedef int (*virSecurityDomainGetProcessLabel) (virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, + pid_t pid, virSecurityLabelPtr sec); typedef int (*virSecurityDomainSetProcessLabel) (virSecurityManagerPtr mgr, - virDomainObjPtr vm); + virDomainDefPtr def); typedef int (*virSecurityDomainSecurityVerify) (virSecurityManagerPtr mgr, virDomainDefPtr def); typedef int (*virSecurityDomainSetImageFDLabel) (virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, int fd); struct _virSecurityDriver { diff --git a/src/security/security_manager.c b/src/security/security_manager.c index cae9b83..2e4956a 100644 --- a/src/security/security_manager.c +++ b/src/security/security_manager.c @@ -150,7 +150,7 @@ bool virSecurityManagerGetAllowDiskFormatProbing(virSecurityManagerPtr mgr) } int virSecurityManagerRestoreImageLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, virDomainDiskDefPtr disk) { if (mgr->drv->domainRestoreSecurityImageLabel) @@ -161,7 +161,7 @@ int virSecurityManagerRestoreImageLabel(virSecurityManagerPtr mgr, } int virSecurityManagerSetDaemonSocketLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr vm) { if (mgr->drv->domainSetSecurityDaemonSocketLabel) return mgr->drv->domainSetSecurityDaemonSocketLabel(mgr, vm); @@ -171,7 +171,7 @@ int virSecurityManagerSetDaemonSocketLabel(virSecurityManagerPtr mgr, } int virSecurityManagerSetSocketLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr vm) { if (mgr->drv->domainSetSecuritySocketLabel) return mgr->drv->domainSetSecuritySocketLabel(mgr, vm); @@ -181,7 +181,7 @@ int virSecurityManagerSetSocketLabel(virSecurityManagerPtr mgr, } int virSecurityManagerClearSocketLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr vm) { if (mgr->drv->domainClearSecuritySocketLabel) return mgr->drv->domainClearSecuritySocketLabel(mgr, vm); @@ -191,7 +191,7 @@ int virSecurityManagerClearSocketLabel(virSecurityManagerPtr mgr, } int virSecurityManagerSetImageLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, virDomainDiskDefPtr disk) { if (mgr->drv->domainSetSecurityImageLabel) @@ -202,7 +202,7 @@ int virSecurityManagerSetImageLabel(virSecurityManagerPtr mgr, } int virSecurityManagerRestoreHostdevLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, virDomainHostdevDefPtr dev) { if (mgr->drv->domainRestoreSecurityHostdevLabel) @@ -213,7 +213,7 @@ int virSecurityManagerRestoreHostdevLabel(virSecurityManagerPtr mgr, } int virSecurityManagerSetHostdevLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, virDomainHostdevDefPtr dev) { if (mgr->drv->domainSetSecurityHostdevLabel) @@ -224,7 +224,7 @@ int virSecurityManagerSetHostdevLabel(virSecurityManagerPtr mgr, } int virSecurityManagerSetSavedStateLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, const char *savefile) { if (mgr->drv->domainSetSavedStateLabel) @@ -235,7 +235,7 @@ int virSecurityManagerSetSavedStateLabel(virSecurityManagerPtr mgr, } int virSecurityManagerRestoreSavedStateLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, const char *savefile) { if (mgr->drv->domainRestoreSavedStateLabel) @@ -246,7 +246,7 @@ int virSecurityManagerRestoreSavedStateLabel(virSecurityManagerPtr mgr, } int virSecurityManagerGenLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr vm) { if (mgr->drv->domainGenSecurityLabel) return mgr->drv->domainGenSecurityLabel(mgr, vm); @@ -256,17 +256,18 @@ int virSecurityManagerGenLabel(virSecurityManagerPtr mgr, } int virSecurityManagerReserveLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr vm, + pid_t pid) { if (mgr->drv->domainReserveSecurityLabel) - return mgr->drv->domainReserveSecurityLabel(mgr, vm); + return mgr->drv->domainReserveSecurityLabel(mgr, vm, pid); virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); return -1; } int virSecurityManagerReleaseLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr vm) { if (mgr->drv->domainReleaseSecurityLabel) return mgr->drv->domainReleaseSecurityLabel(mgr, vm); @@ -276,7 +277,7 @@ int virSecurityManagerReleaseLabel(virSecurityManagerPtr mgr, } int virSecurityManagerSetAllLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, const char *stdin_path) { if (mgr->drv->domainSetSecurityAllLabel) @@ -287,7 +288,7 @@ int virSecurityManagerSetAllLabel(virSecurityManagerPtr mgr, } int virSecurityManagerRestoreAllLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, int migrated) { if (mgr->drv->domainRestoreSecurityAllLabel) @@ -298,18 +299,19 @@ int virSecurityManagerRestoreAllLabel(virSecurityManagerPtr mgr, } int virSecurityManagerGetProcessLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, + pid_t pid, virSecurityLabelPtr sec) { if (mgr->drv->domainGetSecurityProcessLabel) - return mgr->drv->domainGetSecurityProcessLabel(mgr, vm, sec); + return mgr->drv->domainGetSecurityProcessLabel(mgr, vm, pid, sec); virSecurityReportError(VIR_ERR_NO_SUPPORT, __FUNCTION__); return -1; } int virSecurityManagerSetProcessLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr vm) { if (mgr->drv->domainSetSecurityProcessLabel) return mgr->drv->domainSetSecurityProcessLabel(mgr, vm); @@ -337,7 +339,7 @@ int virSecurityManagerVerify(virSecurityManagerPtr mgr, } int virSecurityManagerSetImageFDLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, int fd) { if (mgr->drv->domainSetSecurityImageFDLabel) diff --git a/src/security/security_manager.h b/src/security/security_manager.h index 12cd498..6731d59 100644 --- a/src/security/security_manager.h +++ b/src/security/security_manager.h @@ -51,50 +51,52 @@ const char *virSecurityManagerGetModel(virSecurityManagerPtr mgr); bool virSecurityManagerGetAllowDiskFormatProbing(virSecurityManagerPtr mgr); int virSecurityManagerRestoreImageLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, virDomainDiskDefPtr disk); int virSecurityManagerSetDaemonSocketLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm); + virDomainDefPtr vm); int virSecurityManagerSetSocketLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm); + virDomainDefPtr def); int virSecurityManagerClearSocketLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm); + virDomainDefPtr def); int virSecurityManagerSetImageLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, virDomainDiskDefPtr disk); int virSecurityManagerRestoreHostdevLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, virDomainHostdevDefPtr dev); int virSecurityManagerSetHostdevLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, virDomainHostdevDefPtr dev); int virSecurityManagerSetSavedStateLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, const char *savefile); int virSecurityManagerRestoreSavedStateLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, const char *savefile); int virSecurityManagerGenLabel(virSecurityManagerPtr mgr, - virDomainObjPtr sec); + virDomainDefPtr sec); int virSecurityManagerReserveLabel(virSecurityManagerPtr mgr, - virDomainObjPtr sec); + virDomainDefPtr sec, + pid_t pid); int virSecurityManagerReleaseLabel(virSecurityManagerPtr mgr, - virDomainObjPtr sec); + virDomainDefPtr sec); int virSecurityManagerSetAllLabel(virSecurityManagerPtr mgr, - virDomainObjPtr sec, + virDomainDefPtr sec, const char *stdin_path); int virSecurityManagerRestoreAllLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, int migrated); int virSecurityManagerGetProcessLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, + pid_t pid, virSecurityLabelPtr sec); int virSecurityManagerSetProcessLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm); + virDomainDefPtr def); int virSecurityManagerVerify(virSecurityManagerPtr mgr, virDomainDefPtr def); int virSecurityManagerSetImageFDLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, int fd); #endif /* VIR_SECURITY_MANAGER_H__ */ diff --git a/src/security/security_nop.c b/src/security/security_nop.c index a68a6c0..c3bd426 100644 --- a/src/security/security_nop.c +++ b/src/security/security_nop.c @@ -47,104 +47,106 @@ static const char * virSecurityDriverGetDOINop(virSecurityManagerPtr mgr ATTRIBU } static int virSecurityDomainRestoreImageLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDefPtr vm ATTRIBUTE_UNUSED, virDomainDiskDefPtr disk ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDomainSetDaemonSocketLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED) + virDomainDefPtr vm ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDomainSetSocketLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED) + virDomainDefPtr vm ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDomainClearSocketLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED) + virDomainDefPtr vm ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDomainSetImageLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDefPtr vm ATTRIBUTE_UNUSED, virDomainDiskDefPtr disk ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDomainRestoreHostdevLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDefPtr vm ATTRIBUTE_UNUSED, virDomainHostdevDefPtr dev ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDomainSetHostdevLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDefPtr vm ATTRIBUTE_UNUSED, virDomainHostdevDefPtr dev ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDomainSetSavedStateLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDefPtr vm ATTRIBUTE_UNUSED, const char *savefile ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDomainRestoreSavedStateLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDefPtr vm ATTRIBUTE_UNUSED, const char *savefile ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDomainGenLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr sec ATTRIBUTE_UNUSED) + virDomainDefPtr sec ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDomainReserveLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr sec ATTRIBUTE_UNUSED) + virDomainDefPtr sec ATTRIBUTE_UNUSED, + pid_t pid ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDomainReleaseLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr sec ATTRIBUTE_UNUSED) + virDomainDefPtr sec ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDomainSetAllLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr sec ATTRIBUTE_UNUSED, + virDomainDefPtr sec ATTRIBUTE_UNUSED, const char *stdin_path ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDomainRestoreAllLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDefPtr vm ATTRIBUTE_UNUSED, int migrated ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDomainGetProcessLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED, + virDomainDefPtr vm ATTRIBUTE_UNUSED, + pid_t pid ATTRIBUTE_UNUSED, virSecurityLabelPtr sec ATTRIBUTE_UNUSED) { return 0; } static int virSecurityDomainSetProcessLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm ATTRIBUTE_UNUSED) + virDomainDefPtr vm ATTRIBUTE_UNUSED) { return 0; } @@ -156,7 +158,7 @@ static int virSecurityDomainVerifyNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED } static int virSecurityDomainSetFDLabelNop(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr sec ATTRIBUTE_UNUSED, + virDomainDefPtr sec ATTRIBUTE_UNUSED, int fd ATTRIBUTE_UNUSED) { return 0; diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 78c0d45..8b7c0ed 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -162,7 +162,7 @@ SELinuxInitialize(void) static int SELinuxGenSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm) + virDomainDefPtr def) { int rc = -1; char *mcs = NULL; @@ -171,40 +171,40 @@ SELinuxGenSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, int c2 = 0; context_t ctx = NULL; - if ((vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC) && - !vm->def->seclabel.baselabel && - vm->def->seclabel.model) { + if ((def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC) && + !def->seclabel.baselabel && + def->seclabel.model) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("security model already defined for VM")); return rc; } - if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC && - vm->def->seclabel.label) { + if (def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC && + def->seclabel.label) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("security label already defined for VM")); return rc; } - if (vm->def->seclabel.imagelabel) { + if (def->seclabel.imagelabel) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("security image label already defined for VM")); return rc; } - if (vm->def->seclabel.model && - STRNEQ(vm->def->seclabel.model, SECURITY_SELINUX_NAME)) { + if (def->seclabel.model && + STRNEQ(def->seclabel.model, SECURITY_SELINUX_NAME)) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("security label model %s is not supported with selinux"), - vm->def->seclabel.model); + def->seclabel.model); return rc; } - if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_STATIC) { - if (!(ctx = context_new(vm->def->seclabel.label)) ) { + if (def->seclabel.type == VIR_DOMAIN_SECLABEL_STATIC) { + if (!(ctx = context_new(def->seclabel.label)) ) { virReportSystemError(errno, _("unable to allocate socket security context '%s'"), - vm->def->seclabel.label); + def->seclabel.label); return rc; } @@ -237,25 +237,25 @@ SELinuxGenSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, } } while (mcsAdd(mcs) == -1); - vm->def->seclabel.label = - SELinuxGenNewContext(vm->def->seclabel.baselabel ? - vm->def->seclabel.baselabel : + def->seclabel.label = + SELinuxGenNewContext(def->seclabel.baselabel ? + def->seclabel.baselabel : default_domain_context, mcs); - if (! vm->def->seclabel.label) { + if (! def->seclabel.label) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("cannot generate selinux context for %s"), mcs); goto cleanup; } } - vm->def->seclabel.imagelabel = SELinuxGenNewContext(default_image_context, mcs); - if (!vm->def->seclabel.imagelabel) { + def->seclabel.imagelabel = SELinuxGenNewContext(default_image_context, mcs); + if (!def->seclabel.imagelabel) { virSecurityReportError(VIR_ERR_INTERNAL_ERROR, _("cannot generate selinux context for %s"), mcs); goto cleanup; } - if (!vm->def->seclabel.model && - !(vm->def->seclabel.model = strdup(SECURITY_SELINUX_NAME))) { + if (!def->seclabel.model && + !(def->seclabel.model = strdup(SECURITY_SELINUX_NAME))) { virReportOOMError(); goto cleanup; } @@ -264,12 +264,12 @@ SELinuxGenSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, cleanup: if (rc != 0) { - if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC) - VIR_FREE(vm->def->seclabel.label); - VIR_FREE(vm->def->seclabel.imagelabel); - if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC && - !vm->def->seclabel.baselabel) - VIR_FREE(vm->def->seclabel.model); + if (def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC) + VIR_FREE(def->seclabel.label); + VIR_FREE(def->seclabel.imagelabel); + if (def->seclabel.type == VIR_DOMAIN_SECLABEL_DYNAMIC && + !def->seclabel.baselabel) + VIR_FREE(def->seclabel.model); } if (ctx) @@ -278,28 +278,29 @@ cleanup: VIR_FREE(mcs); VIR_DEBUG("model=%s label=%s imagelabel=%s baselabel=%s", - NULLSTR(vm->def->seclabel.model), - NULLSTR(vm->def->seclabel.label), - NULLSTR(vm->def->seclabel.imagelabel), - NULLSTR(vm->def->seclabel.baselabel)); + NULLSTR(def->seclabel.model), + NULLSTR(def->seclabel.label), + NULLSTR(def->seclabel.imagelabel), + NULLSTR(def->seclabel.baselabel)); return rc; } static int SELinuxReserveSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm) + virDomainDefPtr def, + pid_t pid) { security_context_t pctx; context_t ctx = NULL; const char *mcs; - if (vm->def->seclabel.type == VIR_DOMAIN_SECLABEL_STATIC) + if (def->seclabel.type == VIR_DOMAIN_SECLABEL_STATIC) return 0; - if (getpidcon(vm->pid, &pctx) == -1) { + if (getpidcon(pid, &pctx) == -1) { virReportSystemError(errno, - _("unable to get PID %d security context"), vm->pid); + _("unable to get PID %d security context"), pid); return -1; } @@ -360,15 +361,16 @@ static const char *SELinuxSecurityGetDOI(virSecurityManagerPtr mgr ATTRIBUTE_UNU static int SELinuxGetSecurityProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm, + virDomainDefPtr def ATTRIBUTE_UNUSED, + pid_t pid, virSecurityLabelPtr sec) { security_context_t ctx; - if (getpidcon(vm->pid, &ctx) == -1) { + if (getpidcon(pid, &ctx) == -1) { virReportSystemError(errno, _("unable to get PID %d security context"), - vm->pid); + pid); return -1; } @@ -543,11 +545,11 @@ err: static int SELinuxRestoreSecurityImageLabelInt(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm, + virDomainDefPtr def, virDomainDiskDefPtr disk, int migrated) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; if (secdef->norelabel) return 0; @@ -588,10 +590,10 @@ SELinuxRestoreSecurityImageLabelInt(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, static int SELinuxRestoreSecurityImageLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, virDomainDiskDefPtr disk) { - return SELinuxRestoreSecurityImageLabelInt(mgr, vm, disk, 0); + return SELinuxRestoreSecurityImageLabelInt(mgr, def, disk, 0); } @@ -626,11 +628,11 @@ SELinuxSetSecurityFileLabel(virDomainDiskDefPtr disk, static int SELinuxSetSecurityImageLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, virDomainDiskDefPtr disk) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; bool allowDiskFormatProbing = virSecurityManagerGetAllowDiskFormatProbing(mgr); if (secdef->norelabel) @@ -648,8 +650,8 @@ static int SELinuxSetSecurityPCILabel(pciDevice *dev ATTRIBUTE_UNUSED, const char *file, void *opaque) { - virDomainObjPtr vm = opaque; - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + virDomainDefPtr def = opaque; + const virSecurityLabelDefPtr secdef = &def->seclabel; return SELinuxSetFilecon(file, secdef->imagelabel); } @@ -658,19 +660,19 @@ static int SELinuxSetSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED, const char *file, void *opaque) { - virDomainObjPtr vm = opaque; - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + virDomainDefPtr def = opaque; + const virSecurityLabelDefPtr secdef = &def->seclabel; return SELinuxSetFilecon(file, secdef->imagelabel); } static int SELinuxSetSecurityHostdevLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm, + virDomainDefPtr def, virDomainHostdevDefPtr dev) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; int ret = -1; if (secdef->norelabel) @@ -687,7 +689,7 @@ SELinuxSetSecurityHostdevLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, if (!usb) goto done; - ret = usbDeviceFileIterate(usb, SELinuxSetSecurityUSBLabel, vm); + ret = usbDeviceFileIterate(usb, SELinuxSetSecurityUSBLabel, def); usbFreeDevice(usb); break; } @@ -701,7 +703,7 @@ SELinuxSetSecurityHostdevLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, if (!pci) goto done; - ret = pciDeviceFileIterate(pci, SELinuxSetSecurityPCILabel, vm); + ret = pciDeviceFileIterate(pci, SELinuxSetSecurityPCILabel, def); pciFreeDevice(pci); break; @@ -735,11 +737,11 @@ SELinuxRestoreSecurityUSBLabel(usbDevice *dev ATTRIBUTE_UNUSED, static int SELinuxRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm, + virDomainDefPtr def, virDomainHostdevDefPtr dev) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; int ret = -1; if (secdef->norelabel) @@ -788,11 +790,11 @@ done: static int -SELinuxSetSecurityChardevLabel(virDomainObjPtr vm, +SELinuxSetSecurityChardevLabel(virDomainDefPtr def, virDomainChrSourceDefPtr dev) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; char *in = NULL, *out = NULL; int ret = -1; @@ -834,11 +836,11 @@ done: } static int -SELinuxRestoreSecurityChardevLabel(virDomainObjPtr vm, +SELinuxRestoreSecurityChardevLabel(virDomainDefPtr def, virDomainChrSourceDefPtr dev) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; char *in = NULL, *out = NULL; int ret = -1; @@ -882,27 +884,24 @@ done: static int -SELinuxRestoreSecurityChardevCallback(virDomainDefPtr def ATTRIBUTE_UNUSED, +SELinuxRestoreSecurityChardevCallback(virDomainDefPtr def, virDomainChrDefPtr dev, - void *opaque) + void *opaque ATTRIBUTE_UNUSED) { - virDomainObjPtr vm = opaque; - /* This is taken care of by processing of def->serials */ if (dev->deviceType == VIR_DOMAIN_CHR_DEVICE_TYPE_CONSOLE && dev->targetType == VIR_DOMAIN_CHR_CONSOLE_TARGET_TYPE_SERIAL) return 0; - return SELinuxRestoreSecurityChardevLabel(vm, &dev->source); + return SELinuxRestoreSecurityChardevLabel(def, &dev->source); } static int -SELinuxRestoreSecuritySmartcardCallback(virDomainDefPtr def ATTRIBUTE_UNUSED, +SELinuxRestoreSecuritySmartcardCallback(virDomainDefPtr def, virDomainSmartcardDefPtr dev, - void *opaque) + void *opaque ATTRIBUTE_UNUSED) { - virDomainObjPtr vm = opaque; const char *database; switch (dev->type) { @@ -916,7 +915,7 @@ SELinuxRestoreSecuritySmartcardCallback(virDomainDefPtr def ATTRIBUTE_UNUSED, return SELinuxRestoreSecurityFileLabel(database); case VIR_DOMAIN_SMARTCARD_TYPE_PASSTHROUGH: - return SELinuxRestoreSecurityChardevLabel(vm, &dev->data.passthru); + return SELinuxRestoreSecurityChardevLabel(def, &dev->data.passthru); default: virSecurityReportError(VIR_ERR_INTERNAL_ERROR, @@ -931,50 +930,50 @@ SELinuxRestoreSecuritySmartcardCallback(virDomainDefPtr def ATTRIBUTE_UNUSED, static int SELinuxRestoreSecurityAllLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm, + virDomainDefPtr def, int migrated ATTRIBUTE_UNUSED) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; int i; int rc = 0; - VIR_DEBUG("Restoring security label on %s", vm->def->name); + VIR_DEBUG("Restoring security label on %s", def->name); if (secdef->norelabel) return 0; - for (i = 0 ; i < vm->def->nhostdevs ; i++) { + for (i = 0 ; i < def->nhostdevs ; i++) { if (SELinuxRestoreSecurityHostdevLabel(mgr, - vm, - vm->def->hostdevs[i]) < 0) + def, + def->hostdevs[i]) < 0) rc = -1; } - for (i = 0 ; i < vm->def->ndisks ; i++) { + for (i = 0 ; i < def->ndisks ; i++) { if (SELinuxRestoreSecurityImageLabelInt(mgr, - vm, - vm->def->disks[i], + def, + def->disks[i], migrated) < 0) rc = -1; } - if (virDomainChrDefForeach(vm->def, + if (virDomainChrDefForeach(def, false, SELinuxRestoreSecurityChardevCallback, - vm) < 0) + NULL) < 0) rc = -1; - if (virDomainSmartcardDefForeach(vm->def, + if (virDomainSmartcardDefForeach(def, false, SELinuxRestoreSecuritySmartcardCallback, - vm) < 0) + NULL) < 0) rc = -1; - if (vm->def->os.kernel && - SELinuxRestoreSecurityFileLabel(vm->def->os.kernel) < 0) + if (def->os.kernel && + SELinuxRestoreSecurityFileLabel(def->os.kernel) < 0) rc = -1; - if (vm->def->os.initrd && - SELinuxRestoreSecurityFileLabel(vm->def->os.initrd) < 0) + if (def->os.initrd && + SELinuxRestoreSecurityFileLabel(def->os.initrd) < 0) rc = -1; return rc; @@ -982,9 +981,9 @@ SELinuxRestoreSecurityAllLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, static int SELinuxReleaseSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm) + virDomainDefPtr def) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; if (secdef->type == VIR_DOMAIN_SECLABEL_DYNAMIC) { if (secdef->label != NULL) { @@ -1006,10 +1005,10 @@ SELinuxReleaseSecurityLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, static int SELinuxSetSavedStateLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm, + virDomainDefPtr def, const char *savefile) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; if (secdef->norelabel) return 0; @@ -1020,10 +1019,10 @@ SELinuxSetSavedStateLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, static int SELinuxRestoreSavedStateLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm, + virDomainDefPtr def, const char *savefile) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; if (secdef->norelabel) return 0; @@ -1058,12 +1057,12 @@ SELinuxSecurityVerify(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, static int SELinuxSetSecurityProcessLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr def) { /* TODO: verify DOI */ - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; - if (vm->def->seclabel.label == NULL) + if (def->seclabel.label == NULL) return 0; if (!STREQ(virSecurityManagerGetModel(mgr), secdef->model)) { @@ -1089,16 +1088,16 @@ SELinuxSetSecurityProcessLabel(virSecurityManagerPtr mgr, static int SELinuxSetSecurityDaemonSocketLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr def) { /* TODO: verify DOI */ - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; context_t execcon = NULL; context_t proccon = NULL; security_context_t scon = NULL; int rc = -1; - if (vm->def->seclabel.label == NULL) + if (def->seclabel.label == NULL) return 0; if (!STREQ(virSecurityManagerGetModel(mgr), secdef->model)) { @@ -1139,7 +1138,7 @@ SELinuxSetSecurityDaemonSocketLabel(virSecurityManagerPtr mgr, } VIR_DEBUG("Setting VM %s socket context %s", - vm->def->name, context_str(proccon)); + def->name, context_str(proccon)); if (setsockcreatecon(context_str(proccon)) == -1) { virReportSystemError(errno, _("unable to set socket security context '%s'"), @@ -1160,9 +1159,9 @@ done: static int SELinuxSetSecuritySocketLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr vm) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &vm->seclabel; int rc = -1; if (secdef->label == NULL) @@ -1178,7 +1177,7 @@ SELinuxSetSecuritySocketLabel(virSecurityManagerPtr mgr, } VIR_DEBUG("Setting VM %s socket context %s", - vm->def->name, secdef->label); + vm->name, secdef->label); if (setsockcreatecon(secdef->label) == -1) { virReportSystemError(errno, _("unable to set socket security context '%s'"), @@ -1197,12 +1196,12 @@ done: static int SELinuxClearSecuritySocketLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr def) { /* TODO: verify DOI */ - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; - if (vm->def->seclabel.label == NULL) + if (def->seclabel.label == NULL) return 0; if (!STREQ(virSecurityManagerGetModel(mgr), secdef->model)) { @@ -1227,27 +1226,24 @@ SELinuxClearSecuritySocketLabel(virSecurityManagerPtr mgr, static int -SELinuxSetSecurityChardevCallback(virDomainDefPtr def ATTRIBUTE_UNUSED, +SELinuxSetSecurityChardevCallback(virDomainDefPtr def, virDomainChrDefPtr dev, - void *opaque) + void *opaque ATTRIBUTE_UNUSED) { - virDomainObjPtr vm = opaque; - /* This is taken care of by processing of def->serials */ if (dev->deviceType == VIR_DOMAIN_CHR_DEVICE_TYPE_CONSOLE && dev->targetType == VIR_DOMAIN_CHR_CONSOLE_TARGET_TYPE_SERIAL) return 0; - return SELinuxSetSecurityChardevLabel(vm, &dev->source); + return SELinuxSetSecurityChardevLabel(def, &dev->source); } static int -SELinuxSetSecuritySmartcardCallback(virDomainDefPtr def ATTRIBUTE_UNUSED, +SELinuxSetSecuritySmartcardCallback(virDomainDefPtr def, virDomainSmartcardDefPtr dev, - void *opaque) + void *opaque ATTRIBUTE_UNUSED) { - virDomainObjPtr vm = opaque; const char *database; switch (dev->type) { @@ -1261,7 +1257,7 @@ SELinuxSetSecuritySmartcardCallback(virDomainDefPtr def ATTRIBUTE_UNUSED, return SELinuxSetFilecon(database, default_content_context); case VIR_DOMAIN_SMARTCARD_TYPE_PASSTHROUGH: - return SELinuxSetSecurityChardevLabel(vm, &dev->data.passthru); + return SELinuxSetSecurityChardevLabel(def, &dev->data.passthru); default: virSecurityReportError(VIR_ERR_INTERNAL_ERROR, @@ -1276,53 +1272,53 @@ SELinuxSetSecuritySmartcardCallback(virDomainDefPtr def ATTRIBUTE_UNUSED, static int SELinuxSetSecurityAllLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr def, const char *stdin_path) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; int i; if (secdef->norelabel) return 0; - for (i = 0 ; i < vm->def->ndisks ; i++) { + for (i = 0 ; i < def->ndisks ; i++) { /* XXX fixme - we need to recursively label the entire tree :-( */ - if (vm->def->disks[i]->type == VIR_DOMAIN_DISK_TYPE_DIR) { + if (def->disks[i]->type == VIR_DOMAIN_DISK_TYPE_DIR) { VIR_WARN("Unable to relabel directory tree %s for disk %s", - vm->def->disks[i]->src, vm->def->disks[i]->dst); + def->disks[i]->src, def->disks[i]->dst); continue; } if (SELinuxSetSecurityImageLabel(mgr, - vm, vm->def->disks[i]) < 0) + def, def->disks[i]) < 0) return -1; } - /* XXX fixme process vm->def->fss if relabel == true */ + /* XXX fixme process def->fss if relabel == true */ - for (i = 0 ; i < vm->def->nhostdevs ; i++) { + for (i = 0 ; i < def->nhostdevs ; i++) { if (SELinuxSetSecurityHostdevLabel(mgr, - vm, - vm->def->hostdevs[i]) < 0) + def, + def->hostdevs[i]) < 0) return -1; } - if (virDomainChrDefForeach(vm->def, + if (virDomainChrDefForeach(def, true, SELinuxSetSecurityChardevCallback, - vm) < 0) + NULL) < 0) return -1; - if (virDomainSmartcardDefForeach(vm->def, + if (virDomainSmartcardDefForeach(def, true, SELinuxSetSecuritySmartcardCallback, - vm) < 0) + NULL) < 0) return -1; - if (vm->def->os.kernel && - SELinuxSetFilecon(vm->def->os.kernel, default_content_context) < 0) + if (def->os.kernel && + SELinuxSetFilecon(def->os.kernel, default_content_context) < 0) return -1; - if (vm->def->os.initrd && - SELinuxSetFilecon(vm->def->os.initrd, default_content_context) < 0) + if (def->os.initrd && + SELinuxSetFilecon(def->os.initrd, default_content_context) < 0) return -1; if (stdin_path) { @@ -1337,10 +1333,10 @@ SELinuxSetSecurityAllLabel(virSecurityManagerPtr mgr, static int SELinuxSetImageFDLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, - virDomainObjPtr vm, + virDomainDefPtr def, int fd) { - const virSecurityLabelDefPtr secdef = &vm->def->seclabel; + const virSecurityLabelDefPtr secdef = &def->seclabel; if (secdef->imagelabel == NULL) return 0; diff --git a/src/security/security_stack.c b/src/security/security_stack.c index 3f601c1..c82865f 100644 --- a/src/security/security_stack.c +++ b/src/security/security_stack.c @@ -106,7 +106,7 @@ virSecurityStackVerify(virSecurityManagerPtr mgr, static int virSecurityStackGenLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr vm) { virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); int rc = 0; @@ -131,7 +131,7 @@ virSecurityStackGenLabel(virSecurityManagerPtr mgr, static int virSecurityStackReleaseLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr vm) { virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); int rc = 0; @@ -150,16 +150,17 @@ virSecurityStackReleaseLabel(virSecurityManagerPtr mgr, static int virSecurityStackReserveLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr vm, + pid_t pid) { virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); int rc = 0; - if (virSecurityManagerReserveLabel(priv->primary, vm) < 0) + if (virSecurityManagerReserveLabel(priv->primary, vm, pid) < 0) rc = -1; #if 0 /* XXX See note in GenLabel */ - if (virSecurityManagerReserveLabel(priv->secondary, vm) < 0) + if (virSecurityManagerReserveLabel(priv->secondary, vm, pid) < 0) rc = -1; #endif @@ -169,7 +170,7 @@ virSecurityStackReserveLabel(virSecurityManagerPtr mgr, static int virSecurityStackSetSecurityImageLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, virDomainDiskDefPtr disk) { virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); @@ -186,7 +187,7 @@ virSecurityStackSetSecurityImageLabel(virSecurityManagerPtr mgr, static int virSecurityStackRestoreSecurityImageLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, virDomainDiskDefPtr disk) { virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); @@ -203,7 +204,7 @@ virSecurityStackRestoreSecurityImageLabel(virSecurityManagerPtr mgr, static int virSecurityStackSetSecurityHostdevLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, virDomainHostdevDefPtr dev) { @@ -221,7 +222,7 @@ virSecurityStackSetSecurityHostdevLabel(virSecurityManagerPtr mgr, static int virSecurityStackRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, virDomainHostdevDefPtr dev) { virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); @@ -238,7 +239,7 @@ virSecurityStackRestoreSecurityHostdevLabel(virSecurityManagerPtr mgr, static int virSecurityStackSetSecurityAllLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, const char *stdin_path) { virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); @@ -255,7 +256,7 @@ virSecurityStackSetSecurityAllLabel(virSecurityManagerPtr mgr, static int virSecurityStackRestoreSecurityAllLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, int migrated) { virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); @@ -272,7 +273,7 @@ virSecurityStackRestoreSecurityAllLabel(virSecurityManagerPtr mgr, static int virSecurityStackSetSavedStateLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, const char *savefile) { virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); @@ -289,7 +290,7 @@ virSecurityStackSetSavedStateLabel(virSecurityManagerPtr mgr, static int virSecurityStackRestoreSavedStateLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, const char *savefile) { virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); @@ -306,7 +307,7 @@ virSecurityStackRestoreSavedStateLabel(virSecurityManagerPtr mgr, static int virSecurityStackSetProcessLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr vm) { virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); int rc = 0; @@ -321,17 +322,18 @@ virSecurityStackSetProcessLabel(virSecurityManagerPtr mgr, static int virSecurityStackGetProcessLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, + pid_t pid, virSecurityLabelPtr seclabel) { virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); int rc = 0; #if 0 - if (virSecurityManagerGetProcessLabel(priv->secondary, vm, seclabel) < 0) + if (virSecurityManagerGetProcessLabel(priv->secondary, vm, pid, seclabel) < 0) rc = -1; #endif - if (virSecurityManagerGetProcessLabel(priv->primary, vm, seclabel) < 0) + if (virSecurityManagerGetProcessLabel(priv->primary, vm, pid, seclabel) < 0) rc = -1; return rc; @@ -340,7 +342,7 @@ virSecurityStackGetProcessLabel(virSecurityManagerPtr mgr, static int virSecurityStackSetDaemonSocketLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr vm) { virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); int rc = 0; @@ -356,7 +358,7 @@ virSecurityStackSetDaemonSocketLabel(virSecurityManagerPtr mgr, static int virSecurityStackSetSocketLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr vm) { virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); int rc = 0; @@ -372,7 +374,7 @@ virSecurityStackSetSocketLabel(virSecurityManagerPtr mgr, static int virSecurityStackClearSocketLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm) + virDomainDefPtr vm) { virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); int rc = 0; @@ -387,7 +389,7 @@ virSecurityStackClearSocketLabel(virSecurityManagerPtr mgr, static int virSecurityStackSetImageFDLabel(virSecurityManagerPtr mgr, - virDomainObjPtr vm, + virDomainDefPtr vm, int fd) { virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); -- 1.7.6.4

2 2

[libvirt] [PATCH 0/6] Enhancements in CPU selection
by Jiri Denemark 11 Jan '12

11 Jan '12

The main goal of this series is to provide an easy way to say that a guest CPU should match host. Details can be found in individual patches. Jiri Denemark (6): tests: Print XML file name in verbose CPU test cpu: Optionally forbid fallback CPU models Add support for cpu mode attribute cpu: Update guest CPU in host-* mode Taint domains configured with cpu mode=host-passthrough qemu: Add support for host CPU modes docs/formatdomain.html.in | 12 +- docs/schemas/domaincommon.rng | 32 +++ src/conf/capabilities.c | 2 +- src/conf/cpu_conf.c | 264 +++++++++++++++----- src/conf/cpu_conf.h | 38 +++- src/conf/domain_conf.c | 5 +- src/conf/domain_conf.h | 1 + src/cpu/cpu.c | 2 +- src/cpu/cpu_x86.c | 47 ++++- src/libvirt_private.syms | 3 + src/qemu/qemu_capabilities.c | 5 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 96 +++++--- src/qemu/qemu_domain.c | 15 +- tests/cputest.c | 22 ++- tests/cputestdata/x86-baseline-1-result.xml | 4 +- tests/cputestdata/x86-baseline-2-result.xml | 4 +- .../cputestdata/x86-baseline-no-vendor-result.xml | 4 +- .../x86-baseline-some-vendors-result.xml | 4 +- tests/cputestdata/x86-guest-nofallback.xml | 18 ++ .../cputestdata/x86-host+guest,model486-result.xml | 4 +- .../x86-host+guest,models,Penryn-result.xml | 4 +- .../x86-host+guest,models,qemu64-result.xml | 4 +- tests/cputestdata/x86-host+guest,models-result.xml | 4 +- tests/cputestdata/x86-host+guest-result.xml | 4 +- tests/cputestdata/x86-host+guest.xml | 4 +- ...6-host+host+host-model,models,Penryn-result.xml | 19 ++ .../cputestdata/x86-host+host-model-nofallback.xml | 19 ++ tests/cputestdata/x86-host+host-model.xml | 18 ++ tests/cputestdata/x86-host+host-passthrough.xml | 18 ++ tests/cputestdata/x86-host+min.xml | 4 +- .../cputestdata/x86-host+nehalem-force-result.xml | 4 +- tests/cputestdata/x86-host+pentium3.xml | 4 +- .../x86-host+strict-force-extra-result.xml | 4 +- .../x86-host-better+pentium3,core2duo-result.xml | 4 +- .../x86-host-better+pentium3,pentium3-result.xml | 4 +- .../x86-host-better+pentium3-result.xml | 4 +- tests/cputestdata/x86-host-model-nofallback.xml | 4 + tests/cputestdata/x86-host-model.xml | 1 + tests/cputestdata/x86-host-passthrough.xml | 1 + tests/cputestdata/x86-host-worse+guest-result.xml | 4 +- tests/qemuhelptest.c | 21 +- tests/qemuxml2argvdata/qemu-lib.sh | 50 ++++ tests/qemuxml2argvdata/qemu-supported-cpus.sh | 15 ++ tests/qemuxml2argvdata/qemu.sh | 51 +---- tests/qemuxml2argvdata/qemuxml2argv-cpu-exact1.xml | 2 +- .../qemuxml2argv-cpu-exact2-nofallback.args | 4 + .../qemuxml2argv-cpu-exact2-nofallback.xml | 35 +++ .../qemuxml2argv-cpu-fallback.args | 19 ++ .../qemuxml2argvdata/qemuxml2argv-cpu-fallback.xml | 25 ++ .../qemuxml2argv-cpu-host-model-fallback.args | 19 ++ .../qemuxml2argv-cpu-host-model-fallback.xml | 19 ++ .../qemuxml2argv-cpu-host-model-nofallback.xml | 21 ++ .../qemuxml2argv-cpu-host-model.args | 19 ++ .../qemuxml2argv-cpu-host-model.xml | 19 ++ .../qemuxml2argv-cpu-host-passthrough.args | 19 ++ .../qemuxml2argv-cpu-host-passthrough.xml | 19 ++ .../qemuxml2argv-cpu-nofallback.xml | 25 ++ .../qemuxml2argv-cpu-qemu-host-passthrough.xml | 19 ++ tests/qemuxml2argvtest.c | 91 +++++--- .../qemuxml2xmlout-graphics-spice-timeout.xml | 86 +++++++ tests/qemuxml2xmltest.c | 2 +- tests/testutilsqemu.c | 2 + 63 files changed, 1053 insertions(+), 244 deletions(-) create mode 100644 tests/cputestdata/x86-guest-nofallback.xml create mode 100644 tests/cputestdata/x86-host+host+host-model,models,Penryn-result.xml create mode 100644 tests/cputestdata/x86-host+host-model-nofallback.xml create mode 100644 tests/cputestdata/x86-host+host-model.xml create mode 100644 tests/cputestdata/x86-host+host-passthrough.xml create mode 100644 tests/cputestdata/x86-host-model-nofallback.xml create mode 100644 tests/cputestdata/x86-host-model.xml create mode 100644 tests/cputestdata/x86-host-passthrough.xml create mode 100644 tests/qemuxml2argvdata/qemu-lib.sh create mode 100755 tests/qemuxml2argvdata/qemu-supported-cpus.sh create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2-nofallback.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2-nofallback.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-fallback.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-fallback.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-host-model-fallback.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-host-model-fallback.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-host-model-nofallback.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-host-model.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-host-model.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-host-passthrough.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-host-passthrough.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-nofallback.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-qemu-host-passthrough.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-graphics-spice-timeout.xml -- 1.7.8.2

3 15

[libvirt] [PATCH][TCK] add test for get and define save image xml
by Xiaoqiang Hu 11 Jan '12

11 Jan '12

add test for get and define save image xml and there are types of save image file covered in the test: persistent, transient and invalid domain save image --- scripts/qemu/400-save-image-xml.t | 107 +++++++++++++++++++++++++++++++++++++ 1 files changed, 107 insertions(+), 0 deletions(-) create mode 100644 scripts/qemu/400-save-image-xml.t diff --git a/scripts/qemu/400-save-image-xml.t b/scripts/qemu/400-save-image-xml.t new file mode 100644 index 0000000..d584de1 --- /dev/null +++ b/scripts/qemu/400-save-image-xml.t @@ -0,0 +1,107 @@ +# -*- perl -*- +# +# Copyright (C) 2012-2013 Red Hat, Inc. +# Copyright (C) 2012-2013 Xiaoqiang Hu <xhu(a)redhat.com> +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +qemu/400-save-image-xml.t: test get and define xml from save image + +=head1 DESCRIPTION + +The test case validates that it is possible to define and get domain xml +from save image. There are three types of save image file covered in the +test: persistent, transient and invalid domain save image +=cut + +use strict; +use warnings; + +use Test::More tests => 10; + +use Sys::Virt::TCK; +use Test::Exception; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { + $tck->cleanup if $tck; + unlink "tck.img" if -f "tck.img"; +} + +SKIP:{ + skip "Only relevant to QEMU driver", 10 unless $conn->get_type() eq "QEMU"; + + # scenario 1 - get/define xml from transient domain save image + my $xml = $tck->generic_domain("tck")->as_xml; + diag "Creating a new transient domain"; + my $dom; + ok_domain(sub { $dom = $conn->create_domain($xml) }, "created transient domain object"); + + unlink "tck.img" if -f "tck.img"; + eval { $dom->save("tck.img"); }; + SKIP: { + skip "save/restore not implemented", 9 if $@ && err_not_implemented($@); + ok(!$@, "domain saved"); + die $@ if $@; + + my ($savedxmldesc, $savefile); + $savefile = "tck.img"; + diag "Checking that transient domain has gone away"; + ok_error(sub { $conn->get_domain_by_name("tck") }, "NO_DOMAIN error raised from missing domain", + Sys::Virt::Error::ERR_NO_DOMAIN); + eval { $savedxmldesc = $conn->get_save_image_xml_description($savefile, 0); }; + SKIP: { + skip "get/define save img xml not implemented", 7 if $@ && err_not_implemented($@); + $savedxmldesc = $conn->get_save_image_xml_description($savefile, 0); + $savedxmldesc =~ s/destroy/restart/g; + $conn->define_save_image_xml($savefile, $savedxmldesc, 0); + + $savedxmldesc = $conn->get_save_image_xml_description($savefile, 0); + ok(!($savedxmldesc =~ m/destroy/), "the transient domain save image xml has been updated"); + + # scenario 2 - get/define xml from persistent domain save image + my $xml = $tck->generic_domain("tck")->as_xml; + diag "Creating a new persistent domain"; + ok_domain(sub { $dom = $conn->define_domain($xml) }, "created persistent domain object"); + + unlink "tck.img" if -f "tck.img"; + diag "Starting inactive domain"; + $dom->create; + + $dom->save("tck.img"); + diag "Checking that persistent domain is stopped"; + ok_domain(sub { $conn->get_domain_by_name("tck") }, "persistent domain is still there", "tck"); + is($dom->get_id, -1, "running domain with ID == -1"); + + $savedxmldesc = $conn->get_save_image_xml_description($savefile, 0); + $savedxmldesc =~ s/destroy/restart/g; + $conn->define_save_image_xml($savefile, $savedxmldesc, 0); + + $savedxmldesc = $conn->get_save_image_xml_description($savefile, 0); + ok(!($savedxmldesc =~ m/destroy/), "the persistent save image xml has been updated"); + + # scenario 3 - get/define xml from invalid domain save image + unlink "tck.img" if -f "tck.img"; + diag "Creating an invalid save img file"; + `dd if=/dev/null of=tck.img bs=1M count=100 >& /dev/null 2>&1`; + ok($? == 0, "created 100M raw img file: test.img"); + $savefile = "tck.img"; + diag "Getting xml from invalid save image"; + ok_error(sub { $conn->get_save_image_xml_description($savefile, 0) }, "failed to get invalid domain save image xml" ); + } + } +} +# end -- 1.7.1

3 2

[libvirt] QMP: Supporting off tree APIs
by Luiz Capitulino 11 Jan '12

11 Jan '12

On Thu, 5 Jan 2012 13:48:43 +0000 Stefan Hajnoczi <stefanha(a)gmail.com> wrote: > On Wed, Jan 4, 2012 at 12:59 PM, Luiz Capitulino <lcapitulino(a)redhat.com> wrote: > > On Tue, 13 Dec 2011 13:52:27 +0000 > > Stefan Hajnoczi <stefanha(a)linux.vnet.ibm.com> wrote: > > > >> Add the block_stream command, which starts copy backing file contents > >> into the image file. Later patches add control over the background copy > >> speed, cancelation, and querying running streaming operations. > > > > Please also mention that you're adding an event, otherwise it comes as a > > surprise to the reviewer. > > Ok. > > > When we talked about this implementation (ie. having events, cancellation etc) > > I thought you were going to do something very specific to the streaming api, > > like migration. However, you ended up adding async QMP support to the block > > layer. > > > > I have the impression this could be generalized a bit more and be moved to > > QMP instead (and I strongly feel that's what we should do). > > > > There's only one problem: we are waiting for the new QMP server to work on > > that. I hope to have it integrated by the end of this month, but it might > > be possible to add async support to the current server if waiting is not > > an option. > > I'm not sure what you'd like here, could you be more specific? I have > introduced the concept of a block job - a long-running operation on > block devices - and the completion event when the job finishes. I > guess you're thinking of a generic QMP job concept with a completion > event? Exactly. We should have QMP_JOB_COMPLETED instead of BLOCK_JOB_COMPLETED, for example. > Or something else? > > What I'd like to avoid at this stage is changing the QMP API as seen > by clients because we already have at least one client which relies on > this API. I know that sucks and that this is my fault because I've > been dragging out this patch series for too long. But in a situation > like this I think it's better to live with an API that doesn't meet > the current philosophy on nice APIs but works flawlessly with both new > and existing clients. But it depends on the specifics, what changes > do you suggest? [...] > >> diff --git a/qapi-schema.json b/qapi-schema.json > >> index fbbdbe0..65308d2 100644 > >> --- a/qapi-schema.json > >> +++ b/qapi-schema.json > >> @@ -901,3 +901,56 @@ > >> # Notes: Do not use this command. > >> ## > >> { 'command': 'cpu', 'data': {'index': 'int'} } > >> + > >> +## > >> +# @block_stream: > > > > Command names should be verbs and please use an hyphen. > > These commands have been in the Image Streaming API spec from the beginning: > > http://wiki.qemu.org/Features/LiveBlockMigration/ImageStreamingAPI > > We cannot prettify the API at this stage. You, Anthony, and I > discussed QAPI command naming on IRC maybe two months ago and this > seemed to be the way to do it. These commands fit the existing > block_* commands and are already in use by libvirt - if we change > names now we break libvirt. [...] > >> +# > >> +# Since: 1.1 > >> +## > >> +{ 'command': 'block_stream', 'data': { 'device': 'str', '*base': 'str' } } > >> diff --git a/qerror.c b/qerror.c > >> index 14a1d59..605381a 100644 > >> --- a/qerror.c > >> +++ b/qerror.c > >> @@ -174,6 +174,10 @@ static const QErrorStringTable qerror_table[] = { > >> .desc = "No '%(bus)' bus found for device '%(device)'", > >> }, > >> { > >> + .error_fmt = QERR_NOT_SUPPORTED, > >> + .desc = "Not supported", > > > > We have QERR_UNSUPPORTED already. > > I know. We're stuck in a hard place here again because NotSupported > has been in the Image Streaming API spec and hence implemented in > libvirt for a while now. If we change this then an old client which > only understands NotSupported will not know what to do with the > Unsupported error. > > (Unsupported was not in QEMU when the Image Streaming API was defined.) Let me try to understand it: is libvirt relying on an off tree API and we are now required to have stable guarantees to off tree APIs? I can't even express how insane this looks to me, at least not without being too harsh.

5 11

[libvirt] [PATCH] snapshot: allow reuse of existing files in disk snapshot
by Eric Blake 10 Jan '12

10 Jan '12

When disk snapshots were first implemented, libvirt blindly refused to allow an external snapshot destination that already exists, since qemu will blindly overwrite the contents of that file during the snapshot_blkdev monitor command, and we don't like a default of data loss by default. But VDSM has a scenario where NFS permissions are intentionally set so that the destination file can only be created by the management machine, and not the machine where the guest is running, so that libvirt will necessarily see the destination file already existing; adding a flag will allow VDSM to force the file reuse without libvirt complaining of possible data loss. https://bugzilla.redhat.com/show_bug.cgi?id=767104 * include/libvirt/libvirt.h.in (virDomainSnapshotCreateFlags): Add VIR_DOMAIN_SNAPSHOT_CREATE_REUSE_EXT. * src/libvirt.c (virDomainSnapshotCreateXML): Document it. Add note about partial failure. * tools/virsh.c (cmdSnapshotCreate, cmdSnapshotCreateAs): Add new flag. * tools/virsh.pod (snapshot-create, snapshot-create-as): Document it. * src/qemu/qemu_driver.c (qemuDomainSnapshotDiskPrepare) (qemuDomainSnapshotCreateXML): Implement the new flag. --- I'm not sure I have the best name for the proposed flag; alternative suggestions are welcome. include/libvirt/libvirt.h.in | 2 ++ src/libvirt.c | 13 +++++++++++++ src/qemu/qemu_driver.c | 10 +++++++--- tools/virsh.c | 8 +++++++- tools/virsh.pod | 16 +++++++++++++--- 5 files changed, 42 insertions(+), 7 deletions(-) diff --git a/include/libvirt/libvirt.h.in b/include/libvirt/libvirt.h.in index ad6fcce..0b564cf 100644 --- a/include/libvirt/libvirt.h.in +++ b/include/libvirt/libvirt.h.in @@ -2990,6 +2990,8 @@ typedef enum { after snapshot */ VIR_DOMAIN_SNAPSHOT_CREATE_DISK_ONLY = (1 << 4), /* disk snapshot, not system checkpoint */ + VIR_DOMAIN_SNAPSHOT_CREATE_REUSE_EXT = (1 << 5), /* reuse any existing + external files */ } virDomainSnapshotCreateFlags; /* Take a snapshot of the current VM state */ diff --git a/src/libvirt.c b/src/libvirt.c index c288f00..93d1504 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -16520,7 +16520,20 @@ virDomainSnapshotGetConnect(virDomainSnapshotPtr snapshot) * inconsistent (as if power had been pulled), and specifying this * with the VIR_DOMAIN_SNAPSHOT_CREATE_HALT flag risks data loss. * + * By default, if the snapshot involves external files, and any of the + * destination files already exist as a regular file, the snapshot is + * rejected to avoid losing contents of those files. However, if + * @flags includes VIR_DOMAIN_SNAPSHOT_CREATE_REUSE_EXT, then existing + * destination files are instead truncated and reused. + * * Returns an (opaque) virDomainSnapshotPtr on success, NULL on failure. + * Be aware that although libvirt prefers to report errors up front with + * no other effect, there are certain types of failures where a failure + * can occur even though the guest configuration was changed (for + * example, if a disk snapshot request over two disks only fails on the + * second disk, leaving the first disk altered); so after getting a NULL + * return, it can be wise to use virDomainGetXMLDesc() to determine if + * any partial changes occurred. */ virDomainSnapshotPtr virDomainSnapshotCreateXML(virDomainPtr domain, diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 1a7e816..9765a69 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -9693,7 +9693,8 @@ endjob: } static int -qemuDomainSnapshotDiskPrepare(virDomainObjPtr vm, virDomainSnapshotDefPtr def) +qemuDomainSnapshotDiskPrepare(virDomainObjPtr vm, virDomainSnapshotDefPtr def, + bool allow_reuse) { int ret = -1; int i; @@ -9746,7 +9747,7 @@ qemuDomainSnapshotDiskPrepare(virDomainObjPtr vm, virDomainSnapshotDefPtr def) disk->name, disk->file); goto cleanup; } - } else if (!S_ISBLK(st.st_mode)) { + } else if (!(S_ISBLK(st.st_mode) || allow_reuse)) { qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("external snapshot file for disk %s already " "exists and is not a block device: %s"), @@ -10162,11 +10163,14 @@ qemuDomainSnapshotCreateXML(virDomainPtr domain, goto cleanup; if (flags & VIR_DOMAIN_SNAPSHOT_CREATE_DISK_ONLY) { + bool allow_reuse; + + allow_reuse = (flags & VIR_DOMAIN_SNAPSHOT_CREATE_REUSE_EXT) != 0; if (virDomainSnapshotAlignDisks(def, VIR_DOMAIN_DISK_SNAPSHOT_EXTERNAL, false) < 0) goto cleanup; - if (qemuDomainSnapshotDiskPrepare(vm, def) < 0) + if (qemuDomainSnapshotDiskPrepare(vm, def, allow_reuse) < 0) goto cleanup; def->state = VIR_DOMAIN_DISK_SNAPSHOT; } else { diff --git a/tools/virsh.c b/tools/virsh.c index e4b812e..04c1f6e 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -1,7 +1,7 @@ /* * virsh.c: a shell to exercise the libvirt API * - * Copyright (C) 2005, 2007-2011 Red Hat, Inc. + * Copyright (C) 2005, 2007-2012 Red Hat, Inc. * * See COPYING.LIB for the License of this software * @@ -14462,6 +14462,7 @@ static const vshCmdOptDef opts_snapshot_create[] = { {"no-metadata", VSH_OT_BOOL, 0, N_("take snapshot but create no metadata")}, {"halt", VSH_OT_BOOL, 0, N_("halt domain after snapshot is created")}, {"disk-only", VSH_OT_BOOL, 0, N_("capture disk state but not vm state")}, + {"reuse-external", VSH_OT_BOOL, 0, N_("reuse any existing external files")}, {NULL, 0, 0, NULL} }; @@ -14484,6 +14485,8 @@ cmdSnapshotCreate(vshControl *ctl, const vshCmd *cmd) flags |= VIR_DOMAIN_SNAPSHOT_CREATE_HALT; if (vshCommandOptBool(cmd, "disk-only")) flags |= VIR_DOMAIN_SNAPSHOT_CREATE_DISK_ONLY; + if (vshCommandOptBool(cmd, "reuse-external")) + flags |= VIR_DOMAIN_SNAPSHOT_CREATE_REUSE_EXT; if (!vshConnectionUsability(ctl, ctl->conn)) goto cleanup; @@ -14592,6 +14595,7 @@ static const vshCmdOptDef opts_snapshot_create_as[] = { {"no-metadata", VSH_OT_BOOL, 0, N_("take snapshot but create no metadata")}, {"halt", VSH_OT_BOOL, 0, N_("halt domain after snapshot is created")}, {"disk-only", VSH_OT_BOOL, 0, N_("capture disk state but not vm state")}, + {"reuse-external", VSH_OT_BOOL, 0, N_("reuse any existing external files")}, {"diskspec", VSH_OT_ARGV, 0, N_("disk attributes: disk[,snapshot=type][,driver=type][,file=name]")}, {NULL, 0, 0, NULL} @@ -14615,6 +14619,8 @@ cmdSnapshotCreateAs(vshControl *ctl, const vshCmd *cmd) flags |= VIR_DOMAIN_SNAPSHOT_CREATE_HALT; if (vshCommandOptBool(cmd, "disk-only")) flags |= VIR_DOMAIN_SNAPSHOT_CREATE_DISK_ONLY; + if (vshCommandOptBool(cmd, "reuse-external")) + flags |= VIR_DOMAIN_SNAPSHOT_CREATE_REUSE_EXT; if (!vshConnectionUsability(ctl, ctl->conn)) goto cleanup; diff --git a/tools/virsh.pod b/tools/virsh.pod index 138f886..1abf448 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -2024,7 +2024,7 @@ used to represent properties of snapshots. =over 4 =item B<snapshot-create> I<domain> [I<xmlfile>] {[I<--redefine> [I<--current>]] -| [I<--no-metadata>] [I<--halt>] [I<--disk-only>]} +| [I<--no-metadata>] [I<--halt>] [I<--disk-only>] [I<--reuse-external]} Create a snapshot for domain I<domain> with the properties specified in I<xmlfile>. Normally, the only properties settable for a domain snapshot @@ -2061,14 +2061,19 @@ treat the snapshot as current, and cannot revert to the snapshot unless I<--redefine> is later used to teach libvirt about the metadata again). +If I<--reuse-external> is specified, and the snapshot XML requests an +external snapshot with a destination of an existing file, then the +existing file is truncated and reused; otherwise, a snapshot is refused +to avoid losing contents of the existing files. + Existence of snapshot metadata will prevent attempts to B<undefine> a persistent domain. However, for transient domains, snapshot metadata is silently lost when the domain quits running (whether by command such as B<destroy> or by internal guest action). =item B<snapshot-create-as> I<domain> {[I<--print-xml>] -| [I<--no-metadata>] [I<--halt>]} [I<name>] [I<description>] -[I<--disk-only> [[I<--diskspec>] B<diskspec>]... +| [I<--no-metadata>] [I<--halt>] [I<--reuse-existing>]} [I<name>] +[I<description>] [I<--disk-only> [[I<--diskspec>] B<diskspec>]...] Create a snapshot for domain I<domain> with the given <name> and <description>; if either value is omitted, libvirt will choose a @@ -2091,6 +2096,11 @@ results in the following XML: <source file='/path/to,new'/> </disk> +If I<--reuse-external> is specified, and the domain XML or I<diskspec> +option requests an external snapshot with a destination of an existing +file, then the existing file is truncated and reused; otherwise, a +snapshot is refused to avoid losing contents of the existing files. + If I<--no-metadata> is specified, then the snapshot data is created, but any metadata is immediately discarded (that is, libvirt does not treat the snapshot as current, and cannot revert to the snapshot -- 1.7.7.5

2 2

[libvirt] [PATCH 0/6] nwfilter: Enable access to variables via iterator or index
by Stefan Berger 10 Jan '12

10 Jan '12

This patch enables access to variables in filters using indep. iterators ($TEST[$@2]) or via index ($TEST[1]). Three test cases are added that are also being used for libvirt-TCK to check that the instantiation of the filtering rules is correct. Regards, Stefan

2 17

[libvirt] [PATCH] Docs: Improve documents for several APIs
by Osier Yang 10 Jan '12

10 Jan '12

virDomainGetBlockIoTune uses virTypedParameterFlags actually. And The definition of virTypedParameterFlags contains virDomainModificationImpact. --- src/libvirt.c | 12 ++++++------ 1 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/libvirt.c b/src/libvirt.c index c288f00..896d151 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -3691,7 +3691,7 @@ error: * @params: pointer to memory parameter object * (return value, allocated by the caller) * @nparams: pointer to number of memory parameters; input and output - * @flags: bitwise-OR of virDomainModificationImpact and virTypedParameterFlags + * @flags: bitwise-OR of virTypedParameterFlags * * Get all memory parameters. On input, @nparams gives the size of the * @params array; on output, @nparams gives how many slots were filled @@ -3833,7 +3833,7 @@ error: * @params: pointer to numa parameter object * (return value, allocated by the caller) * @nparams: pointer to number of numa parameters - * @flags: bitwise-OR of virDomainModificationImpact and virTypedParameterFlags + * @flags: bitwise-OR of virTypedParameterFlags * * Get all numa parameters. On input, @nparams gives the size of the * @params array; on output, @nparams gives how many slots were filled @@ -3961,7 +3961,7 @@ error: * @params: pointer to blkio parameter object * (return value, allocated by the caller) * @nparams: pointer to number of blkio parameters; input and output - * @flags: bitwise-OR of virDomainModificationImpact and virTypedParameterFlags + * @flags: bitwise-OR of virTypedParameterFlags * * Get all blkio parameters. On input, @nparams gives the size of the * @params array; on output, @nparams gives how many slots were filled @@ -6670,7 +6670,7 @@ error: * @nparams: pointer to number of scheduler parameter * (this value should be same than the returned value * nparams of virDomainGetSchedulerType()); input and output - * @flags: bitwise-OR of virDomainModificationImpact and virTypedParameterFlags + * @flags: bitwise-OR of virTypedParameterFlags * * Get all scheduler parameters. On input, @nparams gives the size of the * @params array; on output, @nparams gives how many slots were filled @@ -7149,7 +7149,7 @@ error: * @params: pointer to interface parameter objects * (return value, allocated by the caller) * @nparams: pointer to number of interface parameter; input and output - * @flags: bitwise-OR of virDomainModificationImpact and virTypedParameterFlags + * @flags: bitwise-OR of virTypedParameterFlags * * Get all interface parameters. On input, @nparams gives the size of * the @params array; on output, @nparams gives how many slots were @@ -17790,7 +17790,7 @@ error: * @params: Pointer to blkio parameter object * (return value, allocated by the caller) * @nparams: Pointer to number of blkio parameters - * @flags: An OR'ed set of virDomainModificationImpact + * @flags: bitwise-OR of virTypedParameterFlags * * Get all block IO tunable parameters for a given device. On input, * @nparams gives the size of the @params array; on output, @nparams -- 1.7.7.3

2 4

[libvirt] [PATCH] qemu: check for kvm availability before starting kvm guests
by Laine Stump 10 Jan '12

10 Jan '12

This *kind of* addresses: https://bugzilla.redhat.com/show_bug.cgi?id=772395 (it doesn't eliminate the failure to start, but causes libvirt to give a better idea about the cause of the failure). If a guest uses a kvm emulator (e.g. /usr/bin/qemu-kvm) and the guest is started when kvm isn't available (either because virtualization is unavailable / has been disabled in the BIOS, or the kvm modules haven't been loaded for some reason), a semi-cryptic error message is logged: libvirtError: internal error Child process (LC_ALL=C PATH=/sbin:/usr/sbin:/bin:/usr/bin /usr/bin/qemu-kvm -device ? -device pci-assign,? -device virtio-blk-pci,? -device virtio-net-pci,?) status unexpected: exit status 1 This patch notices at process start that a guest needs kvm, and checks for the presence of /dev/kvm (a reasonable indicator that kvm is available) before trying to execute the qemu binary. If kvm isn't available, a more useful (too verbose??) error is logged. --- src/qemu/qemu_process.c | 11 +++++++++++ 1 files changed, 11 insertions(+), 0 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 105b895..e0fd073 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -3031,6 +3031,17 @@ int qemuProcessStart(virConnectPtr conn, if ((logfile = qemuDomainCreateLog(driver, vm, false)) < 0) goto cleanup; + if (vm->def->virtType == VIR_DOMAIN_VIRT_KVM) { + VIR_DEBUG("Checking for KVM availability"); + if (access("/dev/kvm", F_OK) != 0) { + qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Domain requires KVM, but it is not available. " + "Check that virtualization is enabled in the host BIOS, " + "and host configuration is setup to load the kvm modules.")); + goto cleanup; + } + } + VIR_DEBUG("Determining emulator version"); qemuCapsFree(priv->qemuCaps); priv->qemuCaps = NULL; -- 1.7.7.4

2 2

[libvirt] [PATCH] qemu: fix a typo on qemuDomainSetBlkioParameters
by ajia＠redhat.com 10 Jan '12

10 Jan '12

From: Alex Jia <ajia(a)redhat.com> It should be a copy-paste error, the result is programming will result in an infinite loop again due to without iterating 'j' variable. * src/qemu/qemu_driver.c: fix a typo on qemuDomainSetBlkioParameters. RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=770520 Signed-off-by: Alex Jia <ajia(a)redhat.com> --- src/qemu/qemu_driver.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 1a7e816..383b2be 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6002,7 +6002,7 @@ static int qemuDomainSetBlkioParameters(virDomainPtr dom, ret = -1; continue; } - for (j = 0; j < ndevices; i++) { + for (j = 0; j < ndevices; j++) { rc = virCgroupSetBlkioDeviceWeight(group, devices[j].path, devices[j].weight); -- 1.7.1

3 2

[libvirt] [PATCH libvirt-glib] Fix libvirt error message after finishing a stream
by Marc-André Lureau 10 Jan '12

10 Jan '12

The callback is now added & removed from libvirt-gobject-stream.c It should have been part of c5a239423a215435626bf6d1af75458c5ec03147. #0 virErrorMsg (error=VIR_ERR_INTERNAL_ERROR, info=0x7fffffffcf00 "no stream callback registered") at util/virterror.c:760 #1 0x00007ffff627f304 in virReportErrorHelper (domcode=7, errcode=1, filename=0x7ffff6479a4d "rpc/virnetclientstream.c", funcname=0x7ffff6479ca0 "virNetClientStreamEventRemoveCallback", linenr=514, fmt=<optimized out>) at util/virterror.c:1260 #2 0x00007ffff6339aa4 in virNetClientStreamEventRemoveCallback (st=0x1de8ef0) at rpc/virnetclientstream.c:513 #3 0x00007ffff631a6ba in remoteStreamEventRemoveCallback (st=<optimized out>) at remote/remote_driver.c:3713 #4 0x00007ffff62fe97d in virStreamEventRemoveCallback (stream=0x1db9e00) at libvirt.c:14781 #5 0x00007ffff69114f3 in gvir_stream_update_events (stream=0x1db2570) at libvirt-gobject-stream.c:561 #6 0x00007ffff6911616 in gvir_stream_source_finalize (source=0x1da25e0) at libvirt-gobject-stream.c:606 --- libvirt-gobject/libvirt-gobject-input-stream.c | 1 - libvirt-gobject/libvirt-gobject-output-stream.c | 1 - 2 files changed, 0 insertions(+), 2 deletions(-) diff --git a/libvirt-gobject/libvirt-gobject-input-stream.c b/libvirt-gobject/libvirt-gobject-input-stream.c index 733049b..29d1c29 100644 --- a/libvirt-gobject/libvirt-gobject-input-stream.c +++ b/libvirt-gobject/libvirt-gobject-input-stream.c @@ -197,7 +197,6 @@ static gssize gvir_input_stream_read_finish(GInputStream *stream, count = g_simple_async_result_get_op_res_gssize(simple); - virStreamEventRemoveCallback(handle); virStreamFree(handle); return count; diff --git a/libvirt-gobject/libvirt-gobject-output-stream.c b/libvirt-gobject/libvirt-gobject-output-stream.c index bb82bd3..88fff85 100644 --- a/libvirt-gobject/libvirt-gobject-output-stream.c +++ b/libvirt-gobject/libvirt-gobject-output-stream.c @@ -197,7 +197,6 @@ static gssize gvir_output_stream_write_finish(GOutputStream *stream, count = g_simple_async_result_get_op_res_gssize(simple); - virStreamEventRemoveCallback(handle); virStreamFree(handle); return count; -- 1.7.7.5

2 1

[libvirt] [PATCH 0/4] New command for changing media of changeable disk
by Osier Yang 10 Jan '12

10 Jan '12

This is an improved version of : https://www.redhat.com/archives/libvir-list/2011-December/msg00976.html The changes are: * New helper functions to find and change the disk XML * Use the helper functions in cmdDetachDisk * Merge insert-media and eject-media as change-media * Support --update option. [PATCH 0/4] introduces two new helper functions: vshFindDisk is to find the disk XML node in xml doc with the flags (indicates it's normal disk or changeable disk). VshPrepareDiskXML is to prepare the disk XML for disk changing commands' use. Such as detach-disk. The purpose of this patch is to prepare for upcoming new command "change-disk", which will use the two helper functions too. NB, as I explained previously, the new QEMU commands to separate tray and media management shouldn't block us. [PATCH 1/4] virsh: Two new helper functions for disk device changes [PATCH 2/4] virsh: Use vshFindDisk and vshPrepareDiskXML in [PATCH 3/4] virsh: New command cmdChangeMedia [PATCH 4/4] virsh: Add document for cmdChangeMedia Regards, Osier

1 4

[libvirt] Issue with building libvirt
by Shradha Shah 10 Jan '12

10 Jan '12

Hello all, I have been facing an issue when building libvirt using the following steps: 1) ./autogen.sh --prefix=/usr/ --enable-compile-warnings=error 2) make 3) make install The issue is that the above steps puts the binary in /usr/lib instead of /usr/lib64 on a 64 bit OS (RHEL). [root@c6100l lib]# cat /etc/issue Red Hat Enterprise Linux Server release 6.2 (Santiago) Kernel \r on an \m [root@c6100l lib]# uname -r 2.6.32-220.el6.x86_64 [root@c6100l sshah]# cd /usr/lib [root@c6100l lib]# ll libvirt* -rw-r--r-- 1 root root 14156670 Jan 10 13:59 libvirt.a -rwxr-xr-x 1 root root 998 Jan 10 13:59 libvirt.la -rw-r--r-- 1 root root 75920 Jan 10 13:59 libvirt-qemu.a -rwxr-xr-x 1 root root 1053 Jan 10 13:59 libvirt-qemu.la lrwxrwxrwx 1 root root 21 Jan 10 13:59 libvirt-qemu.so -> libvirt-qemu.so.0.9.4 lrwxrwxrwx 1 root root 21 Jan 10 13:59 libvirt-qemu.so.0 -> libvirt-qemu.so.0.9.4 -rwxr-xr-x 1 root root 55148 Jan 10 13:59 libvirt-qemu.so.0.9.4 lrwxrwxrwx 1 root root 16 Jan 10 13:59 libvirt.so -> libvirt.so.0.9.4 lrwxrwxrwx 1 root root 16 Jan 10 13:59 libvirt.so.0 -> libvirt.so.0.9.4 -rwxr-xr-x 1 root root 7521681 Jan 10 13:59 libvirt.so.0.9.4 This leads to a whole list of other problems. Please may I ask for your help to resolve this issue? Many Thanks, Regards, Shradha Shah

3 4

[libvirt] [PATCH v2] Add new attribute writeout to <filesystem> element
by Deepak C Shetty 10 Jan '12

10 Jan '12

This introduces new attribute writeout with only supported value as immediate. This will be an optional attribute with no defaults. This helps specify whether to skip the host page cache. When writeout is specified, meaning when writeout=immediate a writeback is explicitly initiated for the dirty pages in the host page cache as part of the guest file write operation. Usage: <filesystem type='mount' accessmode='passthrough' writeout='immediate'> <source dir='/export/to/guest'/> <target dir='mount_tag'/> </filesystem> Currently this only works with type='mount' for the QEMU/KVM driver. Signed-off-by: Deepak C Shetty <deepakcs(a)linux.vnet.ibm.com> --- v2: - added writeout as a qemu cap - cosmetic changes in comments - moved to using VIR_ERR_CONFIG_UNSUPPORTED - corrected doc docs/formatdomain.html.in | 9 ++++++++- docs/schemas/domaincommon.rng | 5 +++++ src/conf/domain_conf.c | 29 +++++++++++++++++++++++++++-- src/conf/domain_conf.h | 10 ++++++++++ src/qemu/qemu_capabilities.c | 3 +++ src/qemu/qemu_capabilities.h | 5 +++-- src/qemu/qemu_command.c | 14 ++++++++++++++ 7 files changed, 70 insertions(+), 5 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 9cf0f12..93f754a 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -1303,7 +1303,7 @@ <source name='my-vm-template'/> <target dir='/'/> </filesystem> - <filesystem type='mount' accessmode='passthrough'> + <filesystem type='mount' accessmode='passthrough' writeout='immediate'> <driver type='path'/> <source dir='/export/to/guest'/> <target dir='/import/from/host'/> @@ -1379,6 +1379,13 @@ </dd> </dl> + The filesystem block has an optional attribute <code>writeout</code> with the only + supported value as <code>immediate</code>. It helps specify whether to skip the host page cache. + When writeout is specified, meaning when writeout=immediate a writeback is explicitly initiated + for the dirty pages in the host page cache as part of the guest file write operation. + When this attribute is not specified, there are no defaults, meaning explicit writeback won't + be initiated. + </dd> <dt><code>source</code></dt> diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index 553a6f0..0b37f05 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -1106,6 +1106,11 @@ <value>squash</value> </choice> </attribute> + <attribute name="writeout"> + <choice> + <value>immediate</value> + </choice> + </attribute> </optional> </element> </define> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 495ed33..a548b90 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -257,6 +257,9 @@ VIR_ENUM_IMPL(virDomainFSAccessMode, VIR_DOMAIN_FS_ACCESSMODE_LAST, "mapped", "squash") +VIR_ENUM_IMPL(virDomainFSWriteout, VIR_DOMAIN_FS_WRITEOUT_LAST, + "default", + "immediate") VIR_ENUM_IMPL(virDomainNet, VIR_DOMAIN_NET_TYPE_LAST, "user", @@ -3297,6 +3300,7 @@ virDomainFSDefParseXML(xmlNodePtr node, char *source = NULL; char *target = NULL; char *accessmode = NULL; + char *writeout = NULL; if (VIR_ALLOC(def) < 0) { virReportOOMError(); @@ -3325,6 +3329,17 @@ virDomainFSDefParseXML(xmlNodePtr node, def->accessmode = VIR_DOMAIN_FS_ACCESSMODE_PASSTHROUGH; } + writeout = virXMLPropString(node, "writeout"); + if (writeout) { + if ((def->writeout = virDomainFSWriteoutTypeFromString(writeout)) < 0) { + virDomainReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("unknown filesystem writeout '%s'"), writeout); + goto error; + } + } else { + def->writeout = VIR_DOMAIN_FS_WRITEOUT_DEFAULT; + } + cur = node->children; while (cur != NULL) { if (cur->type == XML_ELEMENT_NODE) { @@ -3387,6 +3402,7 @@ cleanup: VIR_FREE(target); VIR_FREE(source); VIR_FREE(accessmode); + VIR_FREE(writeout); return def; @@ -10046,6 +10062,7 @@ virDomainFSDefFormat(virBufferPtr buf, const char *type = virDomainFSTypeToString(def->type); const char *accessmode = virDomainFSAccessModeTypeToString(def->accessmode); const char *fsdriver = virDomainFSDriverTypeTypeToString(def->fsdriver); + const char *writeout = virDomainFSWriteoutTypeToString(def->writeout); if (!type) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, @@ -10062,12 +10079,20 @@ virDomainFSDefFormat(virBufferPtr buf, if (def->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_PATH || def->fsdriver == VIR_DOMAIN_FS_DRIVER_TYPE_DEFAULT) { virBufferAsprintf(buf, - " <filesystem type='%s' accessmode='%s'>\n", + " <filesystem type='%s' accessmode='%s'", type, accessmode); } else { virBufferAsprintf(buf, - " <filesystem type='%s'>\n", type); + " <filesystem type='%s'", type); } + + /* Don't generate anything if writeout is set to default */ + if (def->writeout) { + virBufferAsprintf(buf, " writeout='%s'", writeout); + } + + /* close the filesystem element */ + virBufferAddLit(buf,">\n"); if (def->fsdriver) { virBufferAsprintf(buf, " <driver type='%s'/>\n", fsdriver); diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 1f6e442..6f65b4a 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -459,12 +459,21 @@ enum virDomainFSAccessMode { VIR_DOMAIN_FS_ACCESSMODE_LAST }; +/* Filesystem Writeout */ +enum virDomainFSWriteout { + VIR_DOMAIN_FS_WRITEOUT_DEFAULT = 0, + VIR_DOMAIN_FS_WRITEOUT_IMMEDIATE, + + VIR_DOMAIN_FS_WRITEOUT_LAST +}; + typedef struct _virDomainFSDef virDomainFSDef; typedef virDomainFSDef *virDomainFSDefPtr; struct _virDomainFSDef { int type; int fsdriver; int accessmode; + int writeout; char *src; char *dst; unsigned int readonly : 1; @@ -1974,6 +1983,7 @@ VIR_ENUM_DECL(virDomainControllerModelUSB) VIR_ENUM_DECL(virDomainFS) VIR_ENUM_DECL(virDomainFSDriverType) VIR_ENUM_DECL(virDomainFSAccessMode) +VIR_ENUM_DECL(virDomainFSWriteout) VIR_ENUM_DECL(virDomainNet) VIR_ENUM_DECL(virDomainNetBackend) VIR_ENUM_DECL(virDomainNetVirtioTxMode) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 43c7578..2af16f3 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -144,6 +144,7 @@ VIR_ENUM_IMPL(qemuCaps, QEMU_CAPS_LAST, "ich9-ahci", "no-acpi", "fsdev-readonly", + "fsdev-writeout", ); struct qemu_feature_flags { @@ -1083,6 +1084,8 @@ qemuCapsComputeCmdFlags(const char *help, qemuCapsSet(flags, QEMU_CAPS_FSDEV); if (strstr(fsdev, "readonly")) qemuCapsSet(flags, QEMU_CAPS_FSDEV_READONLY); + if (strstr(fsdev, "writeout")) + qemuCapsSet(flags, QEMU_CAPS_FSDEV_WRITEOUT); } if (strstr(help, "-smbios type")) qemuCapsSet(flags, QEMU_CAPS_SMBIOS_TYPE); diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index c759baf..5b2f932 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -113,10 +113,11 @@ enum qemuCapsFlags { QEMU_CAPS_NO_SHUTDOWN = 74, /* usable -no-shutdown */ QEMU_CAPS_DRIVE_CACHE_UNSAFE = 75, /* Is cache=unsafe supported? */ - QEMU_CAPS_PCI_ROMBAR = 76, /* -device rombar=0|1 */ + QEMU_CAPS_PCI_ROMBAR = 76, /* -device rombar=0|1 */ QEMU_CAPS_ICH9_AHCI = 77, /* -device ich9-ahci */ QEMU_CAPS_NO_ACPI = 78, /* -no-acpi */ - QEMU_CAPS_FSDEV_READONLY =79, /* -fsdev readonly supported */ + QEMU_CAPS_FSDEV_READONLY = 79, /* -fsdev readonly supported */ + QEMU_CAPS_FSDEV_WRITEOUT = 80, /* -fsdev writeout supported */ QEMU_CAPS_LAST, /* this must always be the last item */ }; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 76f3632..adfc738 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -108,6 +108,10 @@ VIR_ENUM_IMPL(qemuDomainFSDriver, VIR_DOMAIN_FS_DRIVER_TYPE_LAST, "local", "handle"); +VIR_ENUM_DECL(qemuDomainFSWriteout) +VIR_ENUM_IMPL(qemuDomainFSWriteout, VIR_DOMAIN_FS_WRITEOUT_LAST, + "default", + "immediate"); static void uname_normalize (struct utsname *ut) @@ -2084,6 +2088,7 @@ char *qemuBuildFSStr(virDomainFSDefPtr fs, { virBuffer opt = VIR_BUFFER_INITIALIZER; const char *driver = qemuDomainFSDriverTypeToString(fs->fsdriver); + const char *writeout = qemuDomainFSWriteoutTypeToString(fs->writeout); if (fs->type != VIR_DOMAIN_FS_TYPE_MOUNT) { qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", @@ -2108,6 +2113,15 @@ char *qemuBuildFSStr(virDomainFSDefPtr fs, virBufferAddLit(&opt, ",security_model=none"); } } + + if (fs->writeout != VIR_DOMAIN_FS_WRITEOUT_DEFAULT) { + if (qemuCapsGet(qemuCaps, QEMU_CAPS_FSDEV_WRITEOUT)) { + virBufferAsprintf(&opt, ",writeout=%s", writeout); + } else { + qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("filesystem writeout not supported")); + } + } virBufferAsprintf(&opt, ",id=%s%s", QEMU_FSDEV_HOST_PREFIX, fs->info.alias); virBufferAsprintf(&opt, ",path=%s", fs->src);

4 7

[libvirt] Would it make sense to have a <disk device='logicalvolume'>?
by Francesco Pretto 10 Jan '12

10 Jan '12

The questions is this: 1) would it make sense to expose a block device in the host to be mapped like a "logical volume" in the guest (I mean: not actually exposing it as a physical disk)? 2) Is there any existing hypervisor that could be made to work like this? Example scenario: Just suppose I have a real logical volume in the *host* called "/dev/mapper/domain0_home" (it could be any block device, but this would be a real useful configuration). Consider the following hypothetical libvirt configuration: <disk type='block' device='lv'> <source dev='/dev/mapper/domain0_home'/> <target dev='home' bus='virtio'/> </disk> 'lv' stands for "logicavolume". The block device should be automatically mapped in the *guest* as "/dev/mapper/home", and not advertised as a physical disk.

2 5

[libvirt] [PATCH 0/2] VirtFS fixes needed for supporting fs driver in VMM
by Deepak C Shetty 10 Jan '12

10 Jan '12

These are the libvirt changes needed to ensure that the virt-manager changes done for supporting fs driver work well. --- Deepak C Shetty (2): Set default fs driver when not provided in input xml Do not generate security_model when fs driver is anything but 'path' src/conf/domain_conf.c | 15 +++++++++++---- src/qemu/qemu_command.c | 15 +++++++++------ 2 files changed, 20 insertions(+), 10 deletions(-) -- Signature

2 9

[libvirt] [PATCH] Docs: Document Android application using libvirt
by Michal Privoznik 10 Jan '12

10 Jan '12

This is acutally a patch for VM Manager for Android. https://www.redhat.com/archives/libvirt-users/2011-November/msg00076.html --- docs/apps.html.in | 11 +++++++++++ 1 files changed, 11 insertions(+), 0 deletions(-) diff --git a/docs/apps.html.in b/docs/apps.html.in index 8d27b70..29bebbd 100644 --- a/docs/apps.html.in +++ b/docs/apps.html.in @@ -348,5 +348,16 @@ </dd> </dl> + <h2><a name="mobile">Mobile applications</a></h2> + + <dl> + <dt><a href="https://market.android.com/details?id=vm.manager">VM Manager</a></dt> + <dd> + VM Manager is VM (libvirt) manager (over SSH) application. VM Manager + is an application for libvirt VM / Domain management over SSH. + Please keep in mind that this software is under heavy development. + </dd> + </dl> + </body> </html> -- 1.7.3.4

2 2

[libvirt] [PATCH] npiv: Auto-generate WWN if it's not specified
by Osier Yang 10 Jan '12

10 Jan '12

The auto-generated WWN comply with the new addressing schema of WWN: <quote> the first nibble is either hex 5 or 6 followed by a 3-byte vendor identifier and 36 bits for a vendor-specified serial number. </quote> We choose hex 5 for the first nibble. And use Qumranet's OUI (00:1A:4A) as the 3-byte vendor indentifier. The last 36 bits are auto-generated. --- src/conf/node_device_conf.c | 35 ++++++++++++++++++----------------- src/libvirt_private.syms | 1 + src/util/util.c | 20 ++++++++++++++++++++ src/util/util.h | 1 + 4 files changed, 40 insertions(+), 17 deletions(-) diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c index d9dc9ac..e7cc243 100644 --- a/src/conf/node_device_conf.c +++ b/src/conf/node_device_conf.c @@ -63,19 +63,12 @@ VIR_ENUM_IMPL(virNodeDevHBACap, VIR_NODE_DEV_CAP_HBA_LAST, static int virNodeDevCapsDefParseString(const char *xpath, xmlXPathContextPtr ctxt, - char **string, - virNodeDeviceDefPtr def, - const char *missing_error_fmt) + char **string) { char *s; - s = virXPathString(xpath, ctxt); - if (s == NULL) { - virNodeDeviceReportError(VIR_ERR_INTERNAL_ERROR, - missing_error_fmt, - def->name); + if (!(s = virXPathString(xpath, ctxt))) return -1; - } *string = s; return 0; @@ -763,18 +756,26 @@ virNodeDevCapScsiHostParseXML(xmlXPathContextPtr ctxt, if (virNodeDevCapsDefParseString("string(./wwnn[1])", ctxt, - &data->scsi_host.wwnn, - def, - _("no WWNN supplied for '%s'")) < 0) { - goto out; + &data->scsi_host.wwnn) < 0) { + if (virGenerateWWN(&data->scsi_host.wwnn) < 0) { + virNodeDeviceReportError(VIR_ERR_INTERNAL_ERROR, + _("no WWNN supplied for '%s', and " + "auto-generation failed"), + def->name); + goto out; + } } if (virNodeDevCapsDefParseString("string(./wwpn[1])", ctxt, - &data->scsi_host.wwpn, - def, - _("no WWPN supplied for '%s'")) < 0) { - goto out; + &data->scsi_host.wwpn) < 0) { + if (virGenerateWWN(&data->scsi_host.wwpn) < 0) { + virNodeDeviceReportError(VIR_ERR_INTERNAL_ERROR, + _("no WWPN supplied for '%s', and " + "auto-generation failed"), + def->name); + goto out; + } } ctxt->node = orignode2; diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index ac2c52e..3b3b322 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1100,6 +1100,7 @@ virFileWriteStr; virFindFileInPath; virFormatMacAddr; virGenerateMacAddr; +virGenerateWWN; virGetGroupID; virGetHostname; virGetUserDirectory; diff --git a/src/util/util.c b/src/util/util.c index 6f46d53..e6f4559 100644 --- a/src/util/util.c +++ b/src/util/util.c @@ -1837,6 +1837,26 @@ void virGenerateMacAddr(const unsigned char *prefix, addr[5] = virRandom(256); } +#define QUMRANET_OUI "001a4a" + +int virGenerateWWN(char **wwn) { + int suffix[5]; + + suffix[0] = virRandom(16); + suffix[1] = virRandom(256); + suffix[2] = virRandom(256); + suffix[3] = virRandom(256); + suffix[4] = virRandom(256); + + if (virAsprintf(wwn, "%x%s%x%02x%02x%02x%02x", 0x5, QUMRANET_OUI, + suffix[0], suffix[1], suffix[2], + suffix[3], suffix[4]) < 0) { + virReportOOMError(); + return -1; + } + + return 0; +} int virEnumFromString(const char *const*types, unsigned int ntypes, diff --git a/src/util/util.h b/src/util/util.h index c9c785b..d7a0840 100644 --- a/src/util/util.h +++ b/src/util/util.h @@ -186,6 +186,7 @@ void virFormatMacAddr(const unsigned char *addr, char *str); void virGenerateMacAddr(const unsigned char *prefix, unsigned char *addr); +int virGenerateWWN(char **wwn); int virDiskNameToIndex(const char* str); char *virIndexToDiskName(int idx, const char *prefix); -- 1.7.7.3

1 0

[libvirt] [test-API][PATCH] Add domain event type "Shutdown"
by Wayne Sun 10 Jan '12

10 Jan '12

* domain have 7 event types, add the missing shutdown type * shutdown only have 1 detail type 'Finished' --- repos/domain/eventhandler.py | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/repos/domain/eventhandler.py b/repos/domain/eventhandler.py index cdbba90..7d8b635 100644 --- a/repos/domain/eventhandler.py +++ b/repos/domain/eventhandler.py @@ -48,16 +48,18 @@ def eventToString(event): "Suspended", "Resumed", "Stopped" ); + "Shutdown" ); return eventStrings[event]; def detailToString(event, detail): eventStrings = ( ( "Added", "Updated" ), - ( "Removed" ), + ( "Removed", ), ( "Booted", "Migrated", "Restored", "Snapshot" ), ( "Paused", "Migrated", "IOError", "Watchdog" ), ( "Unpaused", "Migrated"), ( "Shutdown", "Destroyed", "Crashed", "Migrated", "Saved", "Failed", "Snapshot") + ( "Finished", ) ) return eventStrings[event][detail] -- 1.7.1

2 1

[libvirt] [PATCH] PolicyKit: Check auth before asking client to obtain it
by Jim Fehlig 09 Jan '12

09 Jan '12

I previously mentioned [1] a PolicyKit issue where libvirt would proceed with authentication even though polkit-auth failed: testusr xen134:~> virsh list --all Attempting to obtain authorization for org.libvirt.unix.manage. polkit-grant-helper: given auth type (8 -> yes) is bogus Failed to obtain authorization for org.libvirt.unix.manage. Id Name State ---------------------------------- 0 Domain-0 running - sles11sp1-pv shut off AFAICT, libvirt attempts to obtain a privilege it already has, causing polkit-auth to fail with above message. Instead of calling obtain and then checking auth, IMO the workflow should be for the server to check auth first, and if that fails ask the client to obtain it and check again. This workflow also allows for checking only successful exit of polkit-auth in virConnectAuthGainPolkit(). [1] https://www.redhat.com/archives/libvir-list/2011-December/msg00837.html --- src/libvirt.c | 2 +- src/remote/remote_driver.c | 11 +++++++++++ 2 files changed, 12 insertions(+), 1 deletions(-) diff --git a/src/libvirt.c b/src/libvirt.c index feb3ca6..9e04a38 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -119,7 +119,7 @@ static int virConnectAuthGainPolkit(const char *privilege) { cmd = virCommandNewArgList(POLKIT_AUTH, "--obtain", privilege, NULL); if (virCommandRun(cmd, &status) < 0 || - status > 1) + status > 0) goto cleanup; ret = 0; diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 7580477..e28840b 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -3121,6 +3121,14 @@ remoteAuthPolkit (virConnectPtr conn, struct private_data *priv, }; VIR_DEBUG("Client initialize PolicyKit-0 authentication"); + /* Check auth first and if it succeeds we are done. */ + memset (&ret, 0, sizeof ret); + if (call (conn, priv, 0, REMOTE_PROC_AUTH_POLKIT, + (xdrproc_t) xdr_void, (char *)NULL, + (xdrproc_t) xdr_remote_auth_polkit_ret, (char *) &ret) == 0) + goto out; + + /* Auth failed. Ask client to obtain it and check again. */ if (auth && auth->cb) { /* Check if the necessary credential type for PolicyKit is supported */ for (i = 0 ; i < auth->ncredtype ; i++) { @@ -3138,9 +3146,11 @@ remoteAuthPolkit (virConnectPtr conn, struct private_data *priv, } } else { VIR_DEBUG("Client auth callback does not support PolicyKit"); + return -1; } } else { VIR_DEBUG("No auth callback provided"); + return -1; } memset (&ret, 0, sizeof ret); @@ -3150,6 +3160,7 @@ remoteAuthPolkit (virConnectPtr conn, struct private_data *priv, return -1; /* virError already set by call */ } +out: VIR_DEBUG("PolicyKit-0 authentication complete"); return 0; } -- 1.7.7

3 4

[libvirt] [PATCH 0/2] nwfilter: Compare filters for equality when updating
by Stefan Berger 09 Jan '12

09 Jan '12

When a filter is updated, compare it and the original one for equality so that unnecessary instantiations of rules can be avoided. Regards, Stefan

1 2

[libvirt] ANNOUNCE: libvirt Perl binding Sys::Virt, release 0.9.9
by Daniel P. Berrange 09 Jan '12

09 Jan '12

I'm happy to announce that the libvirt Perl binding, Sys::Virt, release 0.9.9 is now available for download: http://search.cpan.org/CPAN/authors/id/D/DA/DANBERR/Sys-Virt-0.9.9.tar.gz In this release 0.9.9: - Add all new APIs in libvirt 0.9.9 - Fix crash in get_hostname - Fix docs typos & nesting screwups - Add example for calculating CPU utilization of host - Update META.yml with correct license info - Add missing dep on Time::HiRes - Convert CHANGES file to Changes & format to comply with Test::CPAN::Changes The module homepage, where online documentation, and historical downloads can be found is: http://search.cpan.org/dist/Sys-Virt/ Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|

1 0

[libvirt] [PATCHv2 0/2] qemu: add new disk device='lun' for bus='virtio' & type='block'
by Laine Stump 09 Jan '12

09 Jan '12

This patch series supercedes an earlier series: https://www.redhat.com/archives/libvir-list/2011-December/msg00990.html Just before posting those patches (and leaving for 10 days of holiday), Paolo Bonzini suggested an alternate XML representation (noted in that original message), which has since been discussed and agreed on as the proper way to go. These new patches implement that alternate method: <disk type='block' device='disk' dev='/dev/sda'>  <disk type='block' device='lun' dev='/dev/sda'>

5 13

[libvirt] FOSDEM 2012, libvirt related talks
by Daniel P. Berrange 09 Jan '12

09 Jan '12

As Mark mentioned [1] a month or 2 back, there is a dedicated Virt & Cloud dev room at FOSDEM this year. I'm pleased to say that I will be attending, giving a talk titled "Building application sandboxes on top of LXC and KVM with libvirt" At this talk I will be introducing the libvirt-sandbox toolkit that I have been working on recently: http://libvirt.org/git/?p=libvirt-sandbox.git There will also be a talk by Richard Jones on the topic of libguestfs http://libguestfs.org/ and talks by people representing the oVirt & OpenStack projects, both of which use libvirt in their foundations. So it should be an interesting event to attend for people who are interested in open source virtualization technology, in particular libvirt, KVM & LXC . For further information visit the FOSDEM website: http://fosdem.org/2012/ Regards, Daniel [1] https://www.redhat.com/archives/libvir-list/2011-November/msg00575.html -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|

1 0

[libvirt] [libvirt-glib 1/2] Follow glib conventions for SimpleAsyncResult source tag
by Christophe Fergeau 09 Jan '12

09 Jan '12

g_simple_async_result_is_valid() API documentation says that the source tag field for SimpleAsyncResult objects "by convention, is a pointer to the _async function corresponding to the _finish function from which this function is called" The stream functions were already following this convention, but other places were using the sync function name as the source tag. This commit uses the async function name everywhere. --- libvirt-gobject/libvirt-gobject-connection.c | 12 ++++++------ libvirt-gobject/libvirt-gobject-domain.c | 4 ++-- libvirt-gobject/libvirt-gobject-storage-pool.c | 12 ++++++------ 3 files changed, 14 insertions(+), 14 deletions(-) diff --git a/libvirt-gobject/libvirt-gobject-connection.c b/libvirt-gobject/libvirt-gobject-connection.c index 483533d..70d1adc 100644 --- a/libvirt-gobject/libvirt-gobject-connection.c +++ b/libvirt-gobject/libvirt-gobject-connection.c @@ -478,7 +478,7 @@ void gvir_connection_open_async(GVirConnection *conn, res = g_simple_async_result_new(G_OBJECT(conn), callback, user_data, - gvir_connection_open); + gvir_connection_open_async); g_simple_async_result_run_in_thread(res, gvir_connection_open_helper, G_PRIORITY_DEFAULT, @@ -501,7 +501,7 @@ gboolean gvir_connection_open_finish(GVirConnection *conn, if (G_IS_SIMPLE_ASYNC_RESULT(result)) { GSimpleAsyncResult *simple = G_SIMPLE_ASYNC_RESULT(result); - g_warn_if_fail (g_simple_async_result_get_source_tag(simple) == gvir_connection_open); + g_warn_if_fail (g_simple_async_result_get_source_tag(simple) == gvir_connection_open_async); if (g_simple_async_result_propagate_error(simple, err)) return FALSE; } @@ -886,7 +886,7 @@ void gvir_connection_fetch_domains_async(GVirConnection *conn, res = g_simple_async_result_new(G_OBJECT(conn), callback, user_data, - gvir_connection_fetch_domains); + gvir_connection_fetch_domains_async); g_simple_async_result_run_in_thread(res, gvir_connection_fetch_domains_helper, G_PRIORITY_DEFAULT, @@ -908,7 +908,7 @@ gboolean gvir_connection_fetch_domains_finish(GVirConnection *conn, if (G_IS_SIMPLE_ASYNC_RESULT(result)) { GSimpleAsyncResult *simple = G_SIMPLE_ASYNC_RESULT(result); - g_warn_if_fail (g_simple_async_result_get_source_tag(simple) == gvir_connection_fetch_domains); + g_warn_if_fail (g_simple_async_result_get_source_tag(simple) == gvir_connection_fetch_domains_async); if (g_simple_async_result_propagate_error(simple, err)) return FALSE; } @@ -947,7 +947,7 @@ void gvir_connection_fetch_storage_pools_async(GVirConnection *conn, res = g_simple_async_result_new(G_OBJECT(conn), callback, user_data, - gvir_connection_fetch_storage_pools); + gvir_connection_fetch_storage_pools_async); g_simple_async_result_run_in_thread(res, gvir_connection_fetch_pools_helper, G_PRIORITY_DEFAULT, @@ -970,7 +970,7 @@ gboolean gvir_connection_fetch_storage_pools_finish(GVirConnection *conn, if (G_IS_SIMPLE_ASYNC_RESULT(result)) { GSimpleAsyncResult *simple = G_SIMPLE_ASYNC_RESULT(result); g_warn_if_fail (g_simple_async_result_get_source_tag(simple) == - gvir_connection_fetch_storage_pools); + gvir_connection_fetch_storage_pools_async); if (g_simple_async_result_propagate_error(simple, err)) return FALSE; } diff --git a/libvirt-gobject/libvirt-gobject-domain.c b/libvirt-gobject/libvirt-gobject-domain.c index 9ab6b06..4148a78 100644 --- a/libvirt-gobject/libvirt-gobject-domain.c +++ b/libvirt-gobject/libvirt-gobject-domain.c @@ -788,7 +788,7 @@ void gvir_domain_save_async (GVirDomain *dom, res = g_simple_async_result_new(G_OBJECT(dom), callback, user_data, - gvir_domain_save); + gvir_domain_save_async); g_simple_async_result_set_op_res_gpointer (res, data, (GDestroyNotify) domain_save_data_free); g_simple_async_result_run_in_thread(res, gvir_domain_save_helper, @@ -817,7 +817,7 @@ gboolean gvir_domain_save_finish (GVirDomain *dom, if (G_IS_SIMPLE_ASYNC_RESULT(result)) { GSimpleAsyncResult *simple = G_SIMPLE_ASYNC_RESULT(result); g_warn_if_fail (g_simple_async_result_get_source_tag(simple) == - gvir_domain_save); + gvir_domain_save_async); if (g_simple_async_result_propagate_error(simple, err)) return FALSE; } diff --git a/libvirt-gobject/libvirt-gobject-storage-pool.c b/libvirt-gobject/libvirt-gobject-storage-pool.c index 0ba1768..488f146 100644 --- a/libvirt-gobject/libvirt-gobject-storage-pool.c +++ b/libvirt-gobject/libvirt-gobject-storage-pool.c @@ -437,7 +437,7 @@ void gvir_storage_pool_refresh_async(GVirStoragePool *pool, res = g_simple_async_result_new(G_OBJECT(pool), callback, user_data, - gvir_storage_pool_refresh); + gvir_storage_pool_refresh_async); g_simple_async_result_run_in_thread(res, gvir_storage_pool_refresh_helper, G_PRIORITY_DEFAULT, @@ -460,7 +460,7 @@ gboolean gvir_storage_pool_refresh_finish(GVirStoragePool *pool, if (G_IS_SIMPLE_ASYNC_RESULT(result)) { GSimpleAsyncResult *simple = G_SIMPLE_ASYNC_RESULT(result); g_warn_if_fail (g_simple_async_result_get_source_tag(simple) == - gvir_storage_pool_refresh); + gvir_storage_pool_refresh_async); if (g_simple_async_result_propagate_error(simple, err)) return FALSE; } @@ -627,7 +627,7 @@ void gvir_storage_pool_build_async (GVirStoragePool *pool, res = g_simple_async_result_new(G_OBJECT(pool), callback, user_data, - gvir_storage_pool_build); + gvir_storage_pool_build_async); g_object_set_data(G_OBJECT(res), "StoragePoolBuildData", data); g_simple_async_result_run_in_thread(res, gvir_storage_pool_build_helper, @@ -654,7 +654,7 @@ gboolean gvir_storage_pool_build_finish(GVirStoragePool *pool, if (G_IS_SIMPLE_ASYNC_RESULT(result)) { GSimpleAsyncResult *simple = G_SIMPLE_ASYNC_RESULT(result); g_warn_if_fail (g_simple_async_result_get_source_tag(simple) == - gvir_storage_pool_build); + gvir_storage_pool_build_async); if (g_simple_async_result_propagate_error(simple, err)) return FALSE; } @@ -727,7 +727,7 @@ void gvir_storage_pool_start_async (GVirStoragePool *pool, res = g_simple_async_result_new(G_OBJECT(pool), callback, user_data, - gvir_storage_pool_start); + gvir_storage_pool_start_async); g_object_set_data(G_OBJECT(res), "StoragePoolBuildData", data); g_simple_async_result_run_in_thread(res, gvir_storage_pool_start_helper, @@ -754,7 +754,7 @@ gboolean gvir_storage_pool_start_finish(GVirStoragePool *pool, if (G_IS_SIMPLE_ASYNC_RESULT(result)) { GSimpleAsyncResult *simple = G_SIMPLE_ASYNC_RESULT(result); g_warn_if_fail (g_simple_async_result_get_source_tag(simple) == - gvir_storage_pool_start); + gvir_storage_pool_start_async); if (g_simple_async_result_propagate_error(simple, err)) return FALSE; } -- 1.7.7.5

2 3

[libvirt] [PATCH 0/4 0/1 0/1 V2] Add new public API virDomainGetPcpusUsage() and pcpuinfo command in virsh
by Lai Jiangshan 09 Jan '12

09 Jan '12

"virt-top -1" can call virDomainGetPcpusUsage() periodically and get the CPU activities per CPU. (See the last patch in this series). virsh is also added a pcpuinfo command which calls virDomainGetPcpusUsage(), it gets information about the physic CPUs, such as the usage of CPUs, the current attached vCPUs. # virsh pcpuinfo rhel6 CPU: 0 Curr VCPU: - Usage: 47.3 CPU: 1 Curr VCPU: 1 Usage: 46.8 CPU: 2 Curr VCPU: 0 Usage: 52.7 CPU: 3 Curr VCPU: - Usage: 44.1 Patch for libvirt(4 patches): daemon/remote.c | 68 ++++++++++++++++++++++++++++++ include/libvirt/libvirt.h.in | 5 ++ python/generator.py | 1 + src/driver.h | 7 +++ src/libvirt.c | 51 +++++++++++++++++++++++ src/libvirt_public.syms | 5 ++ src/qemu/qemu.conf | 5 +- src/qemu/qemu_conf.c | 3 +- src/qemu/qemu_driver.c | 74 +++++++++++++++++++++++++++++++++ src/remote/remote_driver.c | 51 +++++++++++++++++++++++ src/remote/remote_protocol.x | 17 +++++++- src/remote_protocol-structs | 13 ++++++ src/util/cgroup.c | 7 +++ src/util/cgroup.h | 1 + tools/virsh.c | 93 ++++++++++++++++++++++++++++++++++++++++++ tools/virsh.pod | 5 ++ 16 files changed, 402 insertions(+), 4 deletions(-) Patch for ocaml-libvirt (1 patch): libvirt/libvirt.ml | 1 + libvirt/libvirt.mli | 4 ++++ libvirt/libvirt_c_oneoffs.c | 25 +++++++++++++++++++++++++ 3 files changed, 30 insertions(+), 0 deletions(-) Patch for virt-top (1 patch): virt-top/virt_top.ml | 75 +++++++++++++++++-------------------------------- 1 files changed, 26 insertions(+), 49 deletions(-) -- 1.7.4.4

4 13

[libvirt] [PATCH] config: report error when script given for inappropriate interface type
by Laine Stump 08 Jan '12

08 Jan '12

This fixes https://bugzilla.redhat.com/show_bug.cgi?id=638633 Although scripts are not used by interfaces of type other than "ethernet" in qemu, due to the fact that the parser stores the script name in a union that is only valid when type is ethernet or bridge, there is no way for anyone except the parser itself to catch the problem of specifying an interface script for an inappropriate interface type (by the time the parsed data gets back to the code that called the parser, all evidence that a script was specified is forgotten). Since the parser itself should be agnostic to which type of interface allows scripts (an example of why: a script specified for an interface of type bridge is valid for xen domains, but not for qemu domains), the solution here is to move the script out of the union(s) in the DomainNetDef, always populate it when specified (regardless of interface type), and let the driver decide whether or not it is appropriate. Currently the qemu, xen, libxml, and uml drivers recognize the script parameter and do something with it (the uml driver only to report that it isn't supported). Those drivers have been updated to log a CONFIG_UNSUPPORTED error when a script is specified for an interface type that's inappropriate for that particular hypervisor. (NB: There was earlier discussion of solving this problem by adding a VALIDATE flag to all libvirt APIs that accept XML, which would cause the XML to be validated against the RNG files. One statement during that discussion was that the RNG shouldn't contain hypervisor-specific things, though, and a proper solution to this problem would require that (again, because a script for an interface of type "bridge" is accepted by xen, but not by qemu). --- src/conf/domain_conf.c | 25 +++++++------------------ src/conf/domain_conf.h | 3 +-- src/libxl/libxl_conf.c | 11 +++++++++-- src/qemu/qemu_command.c | 18 +++++++++++++----- src/qemu/qemu_domain.c | 10 ++++++---- src/qemu/qemu_driver.c | 10 +++++----- src/qemu/qemu_hotplug.c | 2 +- src/uml/uml_conf.c | 11 ++++++----- src/vbox/vbox_tmpl.c | 2 +- src/xenxs/xen_sxpr.c | 20 ++++++++++++++------ src/xenxs/xen_xm.c | 14 ++++++-------- 11 files changed, 69 insertions(+), 57 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 7327667..0190a81 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -956,7 +956,6 @@ void virDomainNetDefFree(virDomainNetDefPtr def) switch (def->type) { case VIR_DOMAIN_NET_TYPE_ETHERNET: VIR_FREE(def->data.ethernet.dev); - VIR_FREE(def->data.ethernet.script); VIR_FREE(def->data.ethernet.ipaddr); break; @@ -975,7 +974,6 @@ void virDomainNetDefFree(virDomainNetDefPtr def) case VIR_DOMAIN_NET_TYPE_BRIDGE: VIR_FREE(def->data.bridge.brname); - VIR_FREE(def->data.bridge.script); VIR_FREE(def->data.bridge.ipaddr); break; @@ -993,6 +991,7 @@ void virDomainNetDefFree(virDomainNetDefPtr def) break; } + VIR_FREE(def->script); VIR_FREE(def->ifname); virDomainDeviceInfoClear(&def->info); @@ -3764,8 +3763,6 @@ virDomainNetDefParseXML(virCapsPtr caps, xmlStrEqual(cur->name, BAD_CAST "link")) { linkstate = virXMLPropString(cur, "state"); } else if ((script == NULL) && - (def->type == VIR_DOMAIN_NET_TYPE_ETHERNET || - def->type == VIR_DOMAIN_NET_TYPE_BRIDGE) && xmlStrEqual(cur->name, BAD_CAST "script")) { script = virXMLPropString(cur, "path"); } else if (xmlStrEqual (cur->name, BAD_CAST "model")) { @@ -3854,11 +3851,6 @@ virDomainNetDefParseXML(virCapsPtr caps, break; case VIR_DOMAIN_NET_TYPE_ETHERNET: - - if (script != NULL) { - def->data.ethernet.script = script; - script = NULL; - } if (dev != NULL) { def->data.ethernet.dev = dev; dev = NULL; @@ -3877,10 +3869,6 @@ virDomainNetDefParseXML(virCapsPtr caps, } def->data.bridge.brname = bridge; bridge = NULL; - if (script != NULL) { - def->data.bridge.script = script; - script = NULL; - } if (address != NULL) { def->data.bridge.ipaddr = address; address = NULL; @@ -3957,6 +3945,10 @@ virDomainNetDefParseXML(virCapsPtr caps, break; } + if (script != NULL) { + def->script = script; + script = NULL; + } if (ifname != NULL) { def->ifname = ifname; ifname = NULL; @@ -10340,8 +10332,6 @@ virDomainNetDefFormat(virBufferPtr buf, if (def->data.ethernet.ipaddr) virBufferAsprintf(buf, " <ip address='%s'/>\n", def->data.ethernet.ipaddr); - virBufferEscapeString(buf, " <script path='%s'/>\n", - def->data.ethernet.script); break; case VIR_DOMAIN_NET_TYPE_BRIDGE: @@ -10350,8 +10340,6 @@ virDomainNetDefFormat(virBufferPtr buf, if (def->data.bridge.ipaddr) virBufferAsprintf(buf, " <ip address='%s'/>\n", def->data.bridge.ipaddr); - virBufferEscapeString(buf, " <script path='%s'/>\n", - def->data.bridge.script); break; case VIR_DOMAIN_NET_TYPE_SERVER: @@ -10387,7 +10375,8 @@ virDomainNetDefFormat(virBufferPtr buf, break; } - + virBufferEscapeString(buf, " <script path='%s'/>\n", + def->script); if (def->ifname && !((flags & VIR_DOMAIN_XML_INACTIVE) && (STRPREFIX(def->ifname, VIR_NET_GENERATED_PREFIX)))) { diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index cd882bb..03aa5b6 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -574,7 +574,6 @@ struct _virDomainNetDef { union { struct { char *dev; - char *script; char *ipaddr; } ethernet; struct { @@ -597,7 +596,6 @@ struct _virDomainNetDef { } network; struct { char *brname; - char *script; char *ipaddr; } bridge; struct { @@ -613,6 +611,7 @@ struct _virDomainNetDef { bool sndbuf_specified; unsigned long sndbuf; } tune; + char *script; char *ifname; int bootIndex; virDomainDeviceInfo info; diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c index e94e06b..24830e8 100644 --- a/src/libxl/libxl_conf.c +++ b/src/libxl/libxl_conf.c @@ -618,11 +618,18 @@ libxlMakeNic(virDomainDefPtr def, virDomainNetDefPtr l_nic, virReportOOMError(); return -1; } - if (l_nic->data.bridge.script && - (x_nic->script = strdup(l_nic->data.bridge.script)) == NULL) { + if (l_nic->script && + (x_nic->script = strdup(l_nic->script)) == NULL) { virReportOOMError(); return -1; } + } else { + if (l_nic->script) { + libxlError(VIR_ERR_CONFIG_UNSUPPORTED, + _("scripts are not supported on interfaces of type %s"), + virDomainNetTypeToString(l_nic->type)); + return -1; + } } return 0; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index ea1b763..27db980 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -2418,8 +2418,16 @@ qemuBuildHostNetStr(virDomainNetDefPtr net, { bool is_tap = false; virBuffer buf = VIR_BUFFER_INITIALIZER; + enum virDomainNetType netType = virDomainNetGetActualType(net); - switch (virDomainNetGetActualType(net)) { + if (net->script && netType != VIR_DOMAIN_NET_TYPE_ETHERNET) { + qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("scripts are not supported on interfaces of type %s"), + virDomainNetTypeToString(netType)); + return NULL; + } + + switch (netType) { case VIR_DOMAIN_NET_TYPE_NETWORK: case VIR_DOMAIN_NET_TYPE_BRIDGE: case VIR_DOMAIN_NET_TYPE_DIRECT: @@ -2435,9 +2443,9 @@ qemuBuildHostNetStr(virDomainNetDefPtr net, virBufferAsprintf(&buf, "%cifname=%s", type_sep, net->ifname); type_sep = ','; } - if (net->data.ethernet.script) { + if (net->script) { virBufferAsprintf(&buf, "%cscript=%s", type_sep, - net->data.ethernet.script); + net->script); type_sep = ','; } is_tap = true; @@ -2447,7 +2455,7 @@ qemuBuildHostNetStr(virDomainNetDefPtr net, case VIR_DOMAIN_NET_TYPE_SERVER: case VIR_DOMAIN_NET_TYPE_MCAST: virBufferAddLit(&buf, "socket"); - switch (virDomainNetGetActualType(net)) { + switch (netType) { case VIR_DOMAIN_NET_TYPE_CLIENT: virBufferAsprintf(&buf, "%cconnect=%s:%d", type_sep, @@ -6253,7 +6261,7 @@ qemuParseCommandLineNet(virCapsPtr caps, } } else if (def->type == VIR_DOMAIN_NET_TYPE_ETHERNET && STREQ(keywords[i], "script") && STRNEQ(values[i], "")) { - def->data.ethernet.script = values[i]; + def->script = values[i]; values[i] = NULL; } else if (def->type == VIR_DOMAIN_NET_TYPE_ETHERNET && STREQ(keywords[i], "ifname")) { diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index c5b08f9..6b03c62 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -1167,10 +1167,12 @@ void qemuDomainObjCheckNetTaint(struct qemud_driver *driver, virDomainNetDefPtr net, int logFD) { - if ((net->type == VIR_DOMAIN_NET_TYPE_ETHERNET && - net->data.ethernet.script != NULL) || - (net->type == VIR_DOMAIN_NET_TYPE_BRIDGE && - net->data.bridge.script != NULL)) + /* script is only useful for NET_TYPE_ETHERNET (qemu) and + * NET_TYPE_BRIDGE (xen), but could be (incorrectly) specified for + * any interface type. In any case, it's adding user sauce into + * the soup, so it should taint the domain. + */ + if (net->script != NULL) qemuDomainObjTaint(driver, obj, VIR_DOMAIN_TAINT_SHELL_SCRIPTS, logFD); } diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 110c31b..8966cdc 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -4470,8 +4470,8 @@ static char *qemuDomainXMLToNative(virConnectPtr conn, memset(net, 0, sizeof *net); net->type = VIR_DOMAIN_NET_TYPE_ETHERNET; + net->script = NULL; net->data.ethernet.dev = brnamecopy; - net->data.ethernet.script = NULL; net->data.ethernet.ipaddr = NULL; } else { /* actualType is either NETWORK or DIRECT. In either @@ -4481,8 +4481,8 @@ static char *qemuDomainXMLToNative(virConnectPtr conn, memset(net, 0, sizeof *net); net->type = VIR_DOMAIN_NET_TYPE_ETHERNET; + net->script = NULL; net->data.ethernet.dev = NULL; - net->data.ethernet.script = NULL; net->data.ethernet.ipaddr = NULL; } } else if (net->type == VIR_DOMAIN_NET_TYPE_DIRECT) { @@ -4492,19 +4492,19 @@ static char *qemuDomainXMLToNative(virConnectPtr conn, memset(net, 0, sizeof *net); net->type = VIR_DOMAIN_NET_TYPE_ETHERNET; + net->script = NULL; net->data.ethernet.dev = NULL; - net->data.ethernet.script = NULL; net->data.ethernet.ipaddr = NULL; } else if (net->type == VIR_DOMAIN_NET_TYPE_BRIDGE) { + char *script = net->script; char *brname = net->data.bridge.brname; - char *script = net->data.bridge.script; char *ipaddr = net->data.bridge.ipaddr; memset(net, 0, sizeof *net); net->type = VIR_DOMAIN_NET_TYPE_ETHERNET; + net->script = script; net->data.ethernet.dev = brname; - net->data.ethernet.script = script; net->data.ethernet.ipaddr = ipaddr; } net->bootIndex = bootIndex; diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index f3597a1..99f53d5 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1219,7 +1219,7 @@ int qemuDomainChangeNet(struct qemud_driver *driver, case VIR_DOMAIN_NET_TYPE_ETHERNET: if (STRNEQ_NULLABLE(olddev->data.ethernet.dev, dev->data.ethernet.dev) || - STRNEQ_NULLABLE(olddev->data.ethernet.script, dev->data.ethernet.script) || + STRNEQ_NULLABLE(olddev->script, dev->script) || STRNEQ_NULLABLE(olddev->data.ethernet.ipaddr, dev->data.ethernet.ipaddr)) { qemuReportError(VIR_ERR_NO_SUPPORT, _("cannot modify ethernet network device configuration")); diff --git a/src/uml/uml_conf.c b/src/uml/uml_conf.c index 86ca191..316d558 100644 --- a/src/uml/uml_conf.c +++ b/src/uml/uml_conf.c @@ -193,11 +193,6 @@ umlBuildCommandLineNet(virConnectPtr conn, _("IP address not supported for ethernet interface")); goto error; } - if (def->data.ethernet.script) { - umlReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("script execution not supported for ethernet interface")); - goto error; - } break; case VIR_DOMAIN_NET_TYPE_SERVER: @@ -265,6 +260,12 @@ umlBuildCommandLineNet(virConnectPtr conn, break; } + if (def->script) { + umlReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("interface script execution not supported by this driver")); + goto error; + } + virBufferAsprintf(&buf, ",%02x:%02x:%02x:%02x:%02x:%02x", def->mac[0], def->mac[1], def->mac[2], def->mac[3], def->mac[4], def->mac[5]); diff --git a/src/vbox/vbox_tmpl.c b/src/vbox/vbox_tmpl.c index 9909d13..b3267a9 100644 --- a/src/vbox/vbox_tmpl.c +++ b/src/vbox/vbox_tmpl.c @@ -4364,7 +4364,7 @@ vboxAttachNetwork(virDomainDefPtr def, vboxGlobalData *data, IMachine *machine) VIR_DEBUG("NIC(%d): NAT.", i); } else if (def->nets[i]->type == VIR_DOMAIN_NET_TYPE_BRIDGE) { VIR_DEBUG("NIC(%d): brname: %s", i, def->nets[i]->data.bridge.brname); - VIR_DEBUG("NIC(%d): script: %s", i, def->nets[i]->data.bridge.script); + VIR_DEBUG("NIC(%d): script: %s", i, def->nets[i]->script); VIR_DEBUG("NIC(%d): ipaddr: %s", i, def->nets[i]->data.bridge.ipaddr); } diff --git a/src/xenxs/xen_sxpr.c b/src/xenxs/xen_sxpr.c index 124c369..04ba5aa 100644 --- a/src/xenxs/xen_sxpr.c +++ b/src/xenxs/xen_sxpr.c @@ -549,7 +549,7 @@ xenParseSxprNets(virDomainDefPtr def, goto no_memory; if (tmp2 && net->type == VIR_DOMAIN_NET_TYPE_BRIDGE && - !(net->data.bridge.script = strdup(tmp2))) + !(net->script = strdup(tmp2))) goto no_memory; tmp = sexpr_node(node, "device/vif/ip"); if (tmp && @@ -558,7 +558,7 @@ xenParseSxprNets(virDomainDefPtr def, } else { net->type = VIR_DOMAIN_NET_TYPE_ETHERNET; if (tmp2 && - !(net->data.ethernet.script = strdup(tmp2))) + !(net->script = strdup(tmp2))) goto no_memory; tmp = sexpr_node(node, "device/vif/ip"); if (tmp && @@ -1786,6 +1786,14 @@ xenFormatSxprNet(virConnectPtr conn, _("unsupported network type %d"), def->type); return -1; } + if (def->script && + def->type != VIR_DOMAIN_NET_TYPE_BRIDGE && + def->type != VIR_DOMAIN_NET_TYPE_ETHERNET) { + XENXS_ERROR(VIR_ERR_CONFIG_UNSUPPORTED, + _("scripts are not supported on interfaces of type %s"), + virDomainNetTypeToString(def->type)); + return -1; + } if (!isAttach) virBufferAddLit(buf, "(device "); @@ -1800,8 +1808,8 @@ xenFormatSxprNet(virConnectPtr conn, switch (def->type) { case VIR_DOMAIN_NET_TYPE_BRIDGE: virBufferEscapeSexpr(buf, "(bridge '%s')", def->data.bridge.brname); - if (def->data.bridge.script) - script = def->data.bridge.script; + if (def->script) + script = def->script; virBufferEscapeSexpr(buf, "(script '%s')", script); if (def->data.bridge.ipaddr != NULL) @@ -1835,9 +1843,9 @@ xenFormatSxprNet(virConnectPtr conn, break; case VIR_DOMAIN_NET_TYPE_ETHERNET: - if (def->data.ethernet.script) + if (def->script) virBufferEscapeSexpr(buf, "(script '%s')", - def->data.ethernet.script); + def->script); if (def->data.ethernet.ipaddr != NULL) virBufferEscapeSexpr(buf, "(ip '%s')", def->data.ethernet.ipaddr); break; diff --git a/src/xenxs/xen_xm.c b/src/xenxs/xen_xm.c index b415ce8..0aa04f3 100644 --- a/src/xenxs/xen_xm.c +++ b/src/xenxs/xen_xm.c @@ -708,21 +708,19 @@ xenParseXM(virConfPtr conf, int xendConfigVersion, if (bridge[0] && !(net->data.bridge.brname = strdup(bridge))) goto no_memory; - if (script[0] && - !(net->data.bridge.script = strdup(script))) - goto no_memory; if (ip[0] && !(net->data.bridge.ipaddr = strdup(ip))) goto no_memory; } else { - if (script && script[0] && - !(net->data.ethernet.script = strdup(script))) - goto no_memory; if (ip[0] && !(net->data.ethernet.ipaddr = strdup(ip))) goto no_memory; } + if (script && script[0] && + !(net->script = strdup(script))) + goto no_memory; + if (model[0] && !(net->model = strdup(model))) goto no_memory; @@ -1282,8 +1280,8 @@ static int xenFormatXMNet(virConnectPtr conn, break; case VIR_DOMAIN_NET_TYPE_ETHERNET: - if (net->data.ethernet.script) - virBufferAsprintf(&buf, ",script=%s", net->data.ethernet.script); + if (net->script) + virBufferAsprintf(&buf, ",script=%s", net->script); if (net->data.ethernet.ipaddr) virBufferAsprintf(&buf, ",ip=%s", net->data.ethernet.ipaddr); break; -- 1.7.7.4

2 2

[libvirt] [PATCHv2 0/3] helper functions for virTypedParameters
by Eric Blake 07 Jan '12

07 Jan '12

v1 was: https://www.redhat.com/archives/libvir-list/2012-January/msg00102.html New in v2: more cleanups to lxc, and rebase to post-release tree Eric Blake (3): lxc: use live/config helper util: add new file for virTypedParameter utils util: use new virTypedParameter helpers daemon/remote.c | 1 + po/POTFILES.in | 1 + src/Makefile.am | 1 + src/esx/esx_driver.c | 83 +++---- src/libvirt_private.syms | 20 +- src/libxl/libxl_driver.c | 48 +--- src/lxc/lxc_driver.c | 370 +++++++-------------------- src/qemu/qemu_driver.c | 656 ++++++++++++++-------------------------------- src/test/test_driver.c | 29 +-- src/util/util.c | 16 +- src/util/util.h | 4 +- src/util/virtypedparam.c | 187 +++++++++++++ src/util/virtypedparam.h | 37 +++ src/xen/xen_hypervisor.c | 51 ++-- tools/virsh.c | 3 +- 15 files changed, 623 insertions(+), 884 deletions(-) create mode 100644 src/util/virtypedparam.c create mode 100644 src/util/virtypedparam.h -- 1.7.7.5

1 3

[libvirt] [PATCH] qemu: one more client to live/config helper
by Eric Blake 07 Jan '12

07 Jan '12

Commit ae523427 missed one pair of functions that could use the helper routine. * src/qemu/qemu_driver.c (qemuSetSchedulerParametersFlags) (qemuGetSchedulerParametersFlags): Simplify. --- src/qemu/qemu_driver.c | 73 +++++++---------------------------------------- 1 files changed, 11 insertions(+), 62 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index ad592d6..5d50940 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6996,7 +6996,6 @@ static int qemuSetSchedulerParametersFlags(virDomainPtr dom, virDomainObjPtr vm = NULL; virDomainDefPtr vmdef = NULL; int ret = -1; - bool isActive; int rc; virCheckFlags(VIR_DOMAIN_AFFECT_LIVE | @@ -7012,22 +7011,11 @@ static int qemuSetSchedulerParametersFlags(virDomainPtr dom, goto cleanup; } - isActive = virDomainObjIsActive(vm); - - if (flags == VIR_DOMAIN_AFFECT_CURRENT) { - if (isActive) - flags = VIR_DOMAIN_AFFECT_LIVE; - else - flags = VIR_DOMAIN_AFFECT_CONFIG; - } + if (virDomainLiveConfigHelperMethod(driver->caps, vm, &flags, + &vmdef) < 0) + goto cleanup; if (flags & VIR_DOMAIN_AFFECT_CONFIG) { - if (!vm->persistent) { - qemuReportError(VIR_ERR_OPERATION_INVALID, "%s", - _("cannot change persistent config of a transient domain")); - goto cleanup; - } - /* Make a copy for updated domain. */ vmdef = virDomainObjCopyPersistentDef(driver->caps, vm); if (!vmdef) @@ -7035,12 +7023,6 @@ static int qemuSetSchedulerParametersFlags(virDomainPtr dom, } if (flags & VIR_DOMAIN_AFFECT_LIVE) { - if (!isActive) { - qemuReportError(VIR_ERR_OPERATION_INVALID, - "%s", _("domain is not running")); - goto cleanup; - } - if (!qemuCgroupControllerActive(driver, VIR_CGROUP_CONTROLLER_CPU)) { qemuReportError(VIR_ERR_OPERATION_INVALID, "%s", _("cgroup CPU controller is not mounted")); @@ -7238,9 +7220,9 @@ qemuGetSchedulerParametersFlags(virDomainPtr dom, long long quota; int ret = -1; int rc; - bool isActive; bool cpu_bw_status = false; int saved_nparams = 0; + virDomainDefPtr persistentDef; virCheckFlags(VIR_DOMAIN_AFFECT_LIVE | VIR_DOMAIN_AFFECT_CONFIG | @@ -7266,52 +7248,19 @@ qemuGetSchedulerParametersFlags(virDomainPtr dom, goto cleanup; } - isActive = virDomainObjIsActive(vm); - - if (flags == VIR_DOMAIN_AFFECT_CURRENT) { - if (isActive) - flags = VIR_DOMAIN_AFFECT_LIVE; - else - flags = VIR_DOMAIN_AFFECT_CONFIG; - } + if (virDomainLiveConfigHelperMethod(driver->caps, vm, &flags, + &persistentDef) < 0) + goto cleanup; if (flags & VIR_DOMAIN_AFFECT_CONFIG) { - if (!vm->persistent) { - qemuReportError(VIR_ERR_OPERATION_INVALID, "%s", - _("cannot query persistent config of a transient domain")); - goto cleanup; - } - - if (isActive) { - virDomainDefPtr persistentDef; - - persistentDef = virDomainObjGetPersistentDef(driver->caps, vm); - if (!persistentDef) { - qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("can't get persistentDef")); - goto cleanup; - } - shares = persistentDef->cputune.shares; - if (*nparams > 1 && cpu_bw_status) { - period = persistentDef->cputune.period; - quota = persistentDef->cputune.quota; - } - } else { - shares = vm->def->cputune.shares; - if (*nparams > 1 && cpu_bw_status) { - period = vm->def->cputune.period; - quota = vm->def->cputune.quota; - } + shares = persistentDef->cputune.shares; + if (*nparams > 1 && cpu_bw_status) { + period = persistentDef->cputune.period; + quota = persistentDef->cputune.quota; } goto out; } - if (!isActive) { - qemuReportError(VIR_ERR_OPERATION_INVALID, "%s", - _("domain is not running")); - goto cleanup; - } - if (!qemuCgroupControllerActive(driver, VIR_CGROUP_CONTROLLER_CPU)) { qemuReportError(VIR_ERR_OPERATION_INVALID, "%s", _("cgroup CPU controller is not mounted")); -- 1.7.7.4

2 3